# DarkSword: iOS Exploit Chain Adopted by Multiple Threat Actors (CVE-2026-20700, CVE-2025-43529, CVE-2025-31277)

> GTIG reports the proliferation of DarkSword, a full iOS exploit chain leveraging six zero-day vulnerabilities now adopted by Russian espionage group UNC6353, Saudi-targeting cluster UNC6748, and Turkish surveillance vendor PARS Defense, deploying GHOSTBLADE, GHOSTKNIFE, and GHOSTSABER malware families to exfiltrate credentials, cryptocurrency wallets, and communications from up to 270 million vulnerable iPhones across Ukraine, Saudi Arabia, Turkey, and Malaysia.

- **Published:** 2026-03-18T12:00:00Z
- **Last reviewed:** 2026-10-30T13:26:03.868Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0245
- **ID:** TL-2026-0245
- **Severity:** CRITICAL (CVSS 9.8)
- **Category:** ZERO_DAY
- **Status:** ACTIVE
- **Actor:** UNC6353 (Russia)
- **Detections:** 9 · **IOCs:** 128 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-20700, CVE-2025-43529, CVE-2025-31277, CVE-2025-14174, CVE-2025-43510, CVE-2025-43520, CVE-2025-24201

## Description

DarkSword is a sophisticated, full iOS exploit chain and infostealer platform that represents a new phase in mobile threats where advanced exploit capabilities originally developed for nation-state espionage are being commoditized and adopted by multiple distinct threat actors for both surveillance and financial gain.
The exploit chain targets iPhones running iOS versions 18.4 through 18.7 using a multi-stage attack architecture. For devices running iOS prior to 18.6, DarkSword exploits CVE-2025-31277, a JIT optimization type confusion bug in JavaScriptCore. For devices running iOS 18.6-18.7, it leverages CVE-2025-43529, a use-after-free vulnerability in the Data Flow Graph (DFG) JIT layer of JavaScriptCore. Both WebKit vulnerabilities are chained with CVE-2026-20700, a memory corruption bug in dyld (Dynamic Link Editor) used as a user-mode Pointer Authentication Codes (PAC) bypass to achieve arbitrary code execution. Additional vulnerabilities in the chain include CVE-2025-14174 (out-of-bounds memory access in ANGLE), CVE-2025-43510, and CVE-2025-43520.
The attack chain follows a precise sequence: (1) Initial access via watering hole — malicious iframe or script tag injected into compromised legitimate websites loads rce_loader.js from attacker infrastructure; (2) Device fingerprinting — JavaScript identifies the target iOS version and routes to the appropriate exploit module (rce_worker_18.4.js or rce_worker_18.6.js); (3) WebKit exploitation — triggers the appropriate JIT vulnerability for remote code execution; (4) PAC bypass — chains CVE-2026-20700 in dyld to bypass Pointer Authentication Codes; (5) Sandbox escape — uses WebGPU as a pivot point, injecting into mediaplaybackd to break the WebContent sandbox; (6) Privilege escalation — achieves kernel read/write access; (7) Post-exploitation — pe_main.js injects payloads into privileged iOS services including configd, wifid, securityd, UserEventAgent, and Springboard.
Three distinct malware families are deployed as final payloads: GHOSTBLADE, a JavaScript dataminer that collects and exfiltrates data over HTTP(S) without persistence or backdoor functionality; GHOSTKNIFE, details of which remain limited; and GHOSTSABER, a JavaScript backdoor with C2 communication, device enumeration, file listing, data exfiltration, and arbitrary JavaScript execution capabilities.
DarkSword employs a hit-and-run operational pattern with a dwell time measured in minutes. Data exfiltration targets include: device identifiers, SMS/iMessage, call history, address book, WiFi credentials, Safari history and cookies, location data, photos, calendar, health data, notes, emails, installed applications, saved passwords, and messaging platform data from Telegram and WhatsApp. A significant focus on cryptocurrency theft targets exchanges including Coinbase, Binance, Kraken, Kucoin, Okx, and Mexc, as well as wallets including Ledger, Trezor, Metamask, Exodus, Uniswap, Phantom, and Gnosis Safe. After exfiltration, the malware performs filesystem cleanup and process termination to minimize forensic evidence.
GTIG has attributed DarkSword usage to three distinct threat clusters: UNC6353, a Russian-backed espionage group conducting watering hole campaigns against Ukrainian users by compromising Ukrainian government and media websites; UNC6748, which targeted Saudi Arabian users via a Snapchat-themed lure site (snapshare.chat) beginning in early November 2025; and PARS Defense, a Turkish commercial surveillance vendor that deployed DarkSword with improved OPSEC including code obfuscation and ECDH/AES encryption in Turkey (November 2025) and Malaysia (January 2026). The UNC6353 campaign is notable for poor operational security including zero obfuscation of JavaScript/HTML, a server component labeled Dark Sword File Receiver, and evidence of LLM-generated code with detailed comments.
The DarkSword campaign is connected to the Coruna iOS exploit kit, which shares command-and-control infrastructure but is operated by entirely separate actors. This proliferation pattern — where the same exploit chain appears across Russian espionage, Turkish commercial surveillance, and Saudi-targeted operations — signals the commoditization of iOS zero-day capabilities through exploit brokers, with potential links to Russian exploit broker Operation Zero (Matrix LLC).
iVerify estimates up to 270 million iPhone users running iOS 18 or earlier could be susceptible. Lookout reports approximately 15% of all iOS devices currently in use are vulnerable. All six vulnerabilities were patched by Apple, with most fixed prior to iOS 26.3, which addressed the remaining gaps. Users should update to iOS 18.7.3 or iOS 26.3 or later immediately.

## MITRE ATT&CK

- T1189 Drive-by Compromise
- T1583 Acquire Infrastructure
- T1584 Compromise Infrastructure
- T1587 Develop Capabilities
- T1588 Obtain Capabilities
- T1203 Exploitation for Client Execution
- T1059 Command and Scripting Interpreter
- T1068 Exploitation for Privilege Escalation
- T1055 Process Injection
- T1211 Exploitation for Stealth
- T1070 Indicator Removal
- T1027 Obfuscated Files or Information
- T1552 Unsecured Credentials
- T1555 Credentials from Password Stores
- T1082 System Information Discovery
- T1518 Software Discovery
- T1005 Data from Local System
- T1113 Screen Capture
- T1056 Input Capture
- T1115 Clipboard Data
- T1071 Application Layer Protocol
- T1571 Non-Standard Port
- T1041 Exfiltration Over C2 Channel
- T1592 Gather Victim Host Information
- T1608 Stage Capabilities
- T1566 Phishing
- T1204 User Execution
- T1036 Masquerading
- T1539 Steal Web Session Cookie
- T1119 Automated Collection
- T1102 Web Service
- T1588.005 Obtain Capabilities: Exploits
- T1584.004 Compromise Infrastructure: Server
- T1059.007 Command and Scripting Interpreter: JavaScript
- T1070.004 Indicator Removal: File Deletion
- T1622 Debugger Evasion
- T1555.001 Credentials from Password Stores: Keychain
- T1123 Audio Capture
- T1071.001 Application Layer Protocol: Web Protocols
- T1573.001 Encrypted Channel: Symmetric Cryptography

## Sources

- [GTIG: The Proliferation of DarkSword - iOS Exploit Chain Adopted by Multiple Threat Actors](https://cloud.google.com/blog/topics/threat-intelligence/darksword-ios-exploit-chain/)
- [Lookout: Attackers Wielding DarkSword Threaten iOS Users](https://www.lookout.com/threat-intelligence/article/darksword)
- [iVerify: Inside DarkSword - A New iOS Exploit Kit Delivered Via Compromised Legitimate Websites](https://iverify.io/blog/darksword-ios-exploit-kit-explained)
- [CyberScoop: Second iOS exploit kit emerges from suspected Russian hackers](https://cyberscoop.com/second-ios-exploit-kit-emerges-from-suspected-russian-hackers-using-possible-u-s-government-developed-tools/)
- [BleepingComputer: New DarkSword iOS exploit used in infostealer attack on iPhones](https://www.bleepingcomputer.com/news/security/new-darksword-ios-exploit-used-in-infostealer-attack-on-iphones/)
- [Lookout Press Release: Lookout Uncovers DarkSword iOS Exploit Chain](https://www.businesswire.com/news/home/20260317750249/en/Lookout-Uncovers-DarkSword-iOS-Exploit-Chain-Exposing-a-New-Era-of-Mobile-Threats)
- [iVerify: Second Mass Attack Against iOS Disclosed in Two Weeks](https://www.einpresswire.com/article/900224538/iverify-details-darksword-second-mass-attack-against-ios-disclosed-in-two-weeks)
- [SOC Prime: CVE-2026-20700 - Apple Patches Zero-Day Exploited in Sophisticated Attacks](https://socprime.com/blog/cve-2026-20700-vulnerability/)
- [Help Net Security: Apple fixes zero-day flaw (CVE-2026-20700)](https://www.helpnetsecurity.com/2026/02/12/apple-zero-day-fixed-cve-2026-20700/)
- [NVD: CVE-2025-43529](https://nvd.nist.gov/vuln/detail/CVE-2025-43529)
- [NVD: CVE-2025-14174](https://nvd.nist.gov/vuln/detail/CVE-2025-14174)
- [GTIG: Coruna - The Mysterious Journey of a Powerful iOS Exploit Kit](https://cloud.google.com/blog/topics/threat-intelligence/coruna-powerful-ios-exploit-kit)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0245