Executive summary

Google Threat Intelligence Group (GTIG) reported on 18 March 2026 that DarkSword, a full exploit chain for iOS 18.4 to 18.7 built on six vulnerabilities, has been used since at least November 2025 by “multiple commercial surveillance vendors and suspected state-sponsored actors” against targets in Saudi Arabia, Turkey, Malaysia and Ukraine. Its case studies name one vendor, PARS Defense, which GTIG describes as Turkish, and two clusters: UNC6748, and UNC6353, which GTIG calls “a suspected Russian espionage group” without setting out the basis for that label. GTIG says all six flaws were patched with the release of iOS 26.3 on 11 February 2026, most of them earlier, and on 20 March the US Cybersecurity and Infrastructure Security Agency (CISA) added the three not already in its Known Exploited Vulnerabilities (KEV) catalogue. We assess it is likely (B2) that actors beyond those GTIG names are using DarkSword, so iPhones on iOS 18.4 to 18.7 that lack Apple's fixes remain exposed.

Contextual background

GTIG says DarkSword is a new iOS full-chain exploit that “leveraged multiple zero-day vulnerabilities”; its table marks three of the six as exploited as zero-days. Based on toolmarks in recovered payloads, GTIG says it believes the chain is called DarkSword. It says it reported the DarkSword vulnerabilities to Apple in late 2025, although Apple had already fixed CVE-2025-31277 in iOS 18.6 in July 2025, crediting other researchers. GTIG published in coordination with Lookout and iVerify and describes three sets of users:

User, as GTIG describes it Targeting, per GTIG Timing, per GTIG Payload, per GTIG
UNC6748, a threat cluster Saudi Arabian users, through a Snapchat-themed website From early November 2025 GHOSTKNIFE backdoor
The Turkish commercial surveillance vendor PARS Defense Turkey; then Malaysia, by “a different PARS Defense customer” Late November 2025; January 2026 GHOSTSABER backdoor, where recovered
UNC6353, a “suspected Russian espionage actor” Ukrainian users, through a watering hole campaign Dating back to at least December 2025, active through March 2026 GHOSTBLADE data miner

GTIG notified and collaborated with CERT-UA, Ukraine's national computer emergency response team.

Attribution, as each publisher states it. GTIG's 3 March post on the Coruna exploit kit used the same words for UNC6353, “a suspected Russian espionage group”, and put its account of the Ukrainian watering holes under the heading “Government-Backed Attacker Usage”. The DarkSword post notes a Russian-language comment in a file on UNC6353's delivery server. Lookout's 18 March post calls UNC6353 an “unknown, likely Russian, threat actor” whose goals, it assesses, include “both financial gain and espionage aligned with Russian intelligence requirements”. iVerify's 18 March post refers to “the threat actor from Russia linked with Coruna”. Neither GTIG post we read sets out the basis for its Russian label, so we keep GTIG's “suspected”.

Technical analysis

Delivery. GTIG assesses that each actor built its delivery mechanisms on a base set of logic from the DarkSword developers. In GTIG's account, UNC6748's lure redirected victims to a legitimate Snapchat website during infection; PARS Defense encrypted exploits between server and victim and, in January 2026, added device fingerprinting; UNC6353's compromised Ukrainian websites carried a malicious script tag that fetched the first stage from an UNC6353 server. iVerify says that server delivered exploits only to Internet Protocol (IP) addresses from Ukraine.

The chain. GTIG says DarkSword uses JavaScript for every stage and payload, which removes the need to find vulnerabilities to bypass the Page Protection Layer (PPL) or Secure Page Table Monitor (SPTM) mitigations. At the level defenders need, GTIG's stages are:

  1. Remote code execution in JavaScriptCore, Safari's JavaScript engine, through CVE-2025-31277 before iOS 18.6 or CVE-2025-43529 on iOS 18.6 to 18.7, each chained with CVE-2026-20700, a bug in dyld used as a user-mode Pointer Authentication Codes (PAC) bypass.
  2. Escape from Safari's WebContent sandbox into the graphics processing unit (GPU) process through CVE-2025-14174 in ANGLE, which Google develops.
  3. Escape from the GPU process into mediaplaybackd, a system service with more permissions, through CVE-2025-43510, a copy-on-write bug in the XNU kernel.
  4. Kernel privilege escalation through CVE-2025-43520, a race condition in XNU's virtual filesystem (VFS) implementation.

GTIG says UNC6353's version supported only iOS 18.4 to 18.6, while UNC6748's and PARS Defense's also supported iOS 18.7. iVerify and Lookout, which analysed the Ukrainian instance, give its range as iOS 18.4 to 18.6.2.

Stage CVE GTIG's description Zero-day, per GTIG Fixed in, per Apple's notes Added to KEV
Code execution, before iOS 18.6 CVE-2025-31277 Memory corruption in JavaScriptCore No iOS 18.6 20 March 2026
Code execution, iOS 18.6 to 18.7 CVE-2025-43529 Memory corruption in JavaScriptCore Yes iOS 18.7.3 and 26.2 15 December 2025
PAC bypass CVE-2026-20700 User-mode PAC bypass in dyld Yes iOS 26.3 12 February 2026
WebContent sandbox escape CVE-2025-14174 Memory corruption in ANGLE Yes iOS 18.7.3 and 26.2 12 December 2025
GPU sandbox escape CVE-2025-43510 Memory management in the iOS kernel No iOS 18.7.2 and 26.1 20 March 2026
Privilege escalation CVE-2025-43520 Memory corruption in the iOS kernel No iOS 18.7.2 and 26.1 20 March 2026

Apple's record. For CVE-2025-43529, CVE-2025-14174 and CVE-2026-20700, Apple's notes say it is aware of a report that the issue “may have been exploited in an extremely sophisticated attack against specific targeted individuals” on versions of iOS before iOS 26, and credit Google Threat Analysis Group (with Apple, for CVE-2025-14174). The other three entries carry no such note. Apple's iOS 18.6 notes of 29 July 2025 credit CVE-2025-31277 to four named researchers, and Apple credits itself for the kernel flaws, fixed in iOS 26.1 and iOS 18.7.2 on 3 and 5 November 2025 but added to those notes on 12 December 2025, when it released iOS 18.7.3 and iOS 26.2. CISA's catalogue lists CVE-2025-14174 as a Google Chromium flaw.

The 20 March KEV additions. CISA's alert added the three Apple flaws “based on evidence of active exploitation” and does not mention DarkSword. The catalogue as published that day records them as below; CISA's names differ from GTIG's account of the same bugs as a type confusion, a copy-on-write bug and a race condition.

CVE CISA's name Common Weakness Enumeration (CWE) Due Known ransomware campaign use
CVE-2025-31277 Apple Multiple Products Buffer Overflow Vulnerability CWE-119 3 April 2026 Unknown
CVE-2025-43510 Apple Multiple Products Improper Locking Vulnerability CWE-667 3 April 2026 Unknown
CVE-2025-43520 Apple Multiple Products Classic Buffer Overflow Vulnerability CWE-120 3 April 2026 Unknown

The National Vulnerability Database (NVD) change histories to 21 March for CVE-2025-31277 (to November 2025, from November 2025), CVE-2025-43510 and CVE-2025-43520 carry the Common Vulnerability Scoring System (CVSS) 3.1 vectors below. On 19 March, CISA's Authorized Data Publisher (ADP) added GTIG's post to all three records as a reference, which NVD typed as a technical description on 20 March.

CVE CISA ADP vector NVD analysis vector
CVE-2025-31277 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H None in the history
CVE-2025-43510 AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVE-2025-43520 AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

Payloads.

Payload User, per GTIG GTIG's description
GHOSTKNIFE UNC6748 JavaScript backdoor with modules for exfiltrating signed-in accounts, messages, browser data, location history and recordings; can take screenshots and record audio from the microphone; talks to its command-and-control (C2) server over Hypertext Transfer Protocol (HTTP) with a custom encrypted binary protocol; periodically erases crash logs
GHOSTSABER PARS Defense JavaScript backdoor for device and account enumeration, file listing, data exfiltration and arbitrary JavaScript; some commands, including audio recording and geolocation, lack the code to run, and GTIG suspects a follow-on binary module supplies it
GHOSTBLADE UNC6353 Less capable data miner that does not operate continuously; collects iMessage, Telegram and WhatsApp data, device keychains, saved Wi-Fi networks and passwords, location history, iCloud Drive files, Safari cookies, Health data and cryptocurrency wallet data, and exfiltrates over HTTP(S); GTIG assesses the DarkSword developers likely wrote it

For the Ukrainian instance, Lookout says the payload it analysed appears to collect and exfiltrate data “within seconds or at most minutes”, then cleans up and exits, and iVerify says the exploits and injected implants it recovered contain no persistence mechanism.

The mapping below is ours, to MITRE ATT&CK for Mobile; each row rests on behaviour the named source describes.

Technique Basis
T1456 Drive-By Compromise UNC6353's malicious script tag on compromised Ukrainian websites (GTIG)
T1404 Exploitation for Privilege Escalation The kernel stage through CVE-2025-43520 (GTIG)
T1634.001 Credentials from Password Store: Keychain The implant's initial modules extracting passwords from the keychain (iVerify)
T1533 Data from Local System GHOSTBLADE's collection of messaging, location and Health databases (GTIG)
T1646 Exfiltration Over C2 Channel Staged data sent to a C2 server (Lookout)
T1630.002 Indicator Removal on Host: File Deletion GHOSTKNIFE erasing crash logs (GTIG); the Ukrainian implant deleting crash reports (iVerify)

Impact assessment

For an organisation, we assess that the keychains, Safari cookies and Wi-Fi passwords GTIG lists among GHOSTBLADE's targets matter most, as they reach beyond the device.

From third-party market-share data, iVerify estimates that 14.2% of users, about 221,520,000 devices, run iOS 18.4 to 18.6.2, and that about 17.3%, or 270,000,000, may be affected if all iOS 18 versions are susceptible to most of the chain's vulnerabilities.

Apple's iOS 26 notes list iPhone 11 and later. Apple's security releases page, as archived on 19 March, lists iOS 18.7.6 for iPhone XS, iPhone XS Max and iPhone XR, and iOS 26.3.1, both released on 4 March with “no published CVE entries”.

Indicators of compromise

A selection from GTIG's post, defanged. GTIG lists seven network indicators and one file hash, and says it has also put indicators in a collection for registered users of GTI, Google Threat Intelligence; Lookout's post lists further cdncounter[.]net subdomains and an IP address.

Indicator Actor, per GTIG GTIG's context
snapshare[.]chat UNC6748 DarkSword delivery used in Saudi Arabia
sahibndn[.]io PARS Defense DarkSword delivery used in Turkey
static.cdncounter[.]net UNC6353 DarkSword delivery via watering holes in Ukraine
sqwas.shapelie[.]com UNC6353 GHOSTBLADE exfiltration server
2e5a56beb63f21d9347310412ae6efb29fd3db2d3a3fc0798865a29a3c578d35 UNC6353 Extracted GHOSTBLADE sample

Lookout says sqwas.shapelie[.]com appears to be a subdomain the actor created on shapelie[.]com, a compromised Ukrainian domain, so we advise blocking the subdomain, not the parent. GTIG also publishes four YARA rules, one each for GHOSTKNIFE, GHOSTSABER and GHOSTBLADE and one for file paths from DarkSword's implant library.

Detection and hunting guidance

These, like the response and mitigation steps below, are our recommendations except where a source is named.

  • Version inventory. Pull every managed device's iOS version from mobile device management (MDM). Treat as non-compliant any iPhone 11 or later below iOS 26.3.1, which Apple's page of 17 March calls the latest, and any iPhone XS, XS Max or XR below iOS 18.7.6. The partners' thresholds differ: Lookout says devices on iOS 18.7.3 or later, or 26.3 or later, are not susceptible; iVerify recommends iOS 18.7.6 or 26.3.1, which it says mitigate all the vulnerabilities in these chains.
  • Network logs. Search DNS, proxy and mobile web-filter logs from November 2025, GTIG's earliest observation, for the domains above and any other cdncounter[.]net subdomain.
  • Device forensics. iVerify says the malware does not clean Safari's history or other WebKit databases, so the Mobile Verification Toolkit (MVT) or other forensic tools can find the delivery domains, and that its file-based indicators are not backed up, so they can be checked only on the device or in a full file-system dump.
  • Crash patterns. iVerify reports repeated crashes in com.apple.WebKit.WebContent and com.apple.WebKit.GPU when an exploit stage fails, and says that, while one crash is not a strong signal, several within a short period, particularly across services, significantly increase the likelihood of malicious activity. It says the Ukrainian implant deletes the DiagnosticReports directory but misses the main CrashReporter directory; we suggest investigating any device image whose DiagnosticReports directory is missing.
  • Files. Run GTIG's YARA rules over recovered samples and file-system images.

A generic query for the network hunt, to adapt to your schema:

-- Managed-device DNS lookups of DarkSword domains loaded from GTIG's post, since 1 November 2025
SELECT d.event_time, d.device_id, d.query_name
FROM dns_logs d
JOIN ioc_domains i ON d.query_name = i.domain OR d.query_name LIKE '%.' || i.domain
WHERE i.source = 'GTIG DarkSword 2026-03-18'
  AND d.event_time >= '2025-11-01'
ORDER BY d.event_time;

Incident response guidance

  1. Update every iPhone 11 or later to iOS 26.3.1 and every iPhone XS, XS Max or XR to iOS 18.7.6. Where an update is not possible, enable Lockdown Mode, as GTIG recommends.
  2. For any device that contacted a DarkSword domain, preserve evidence first; iVerify's own capture comprised sysdiagnoses, unified logs, crash reports and encrypted backups.
  3. Treat a suspected compromise as a credential and data breach: rotate passwords of accounts signed in on the device, revoke its sessions, change the passwords of Wi-Fi networks it knew, and move cryptocurrency out of wallets on it.
  4. Do not treat a reboot as remediation. For the Ukrainian UNC6353 instance, because Lookout puts the payload's likely dwell time in minutes and iVerify found no persistence, we expect any theft to be over before the device is examined. That reasoning does not cover GHOSTKNIFE or GHOSTSABER, which GTIG describes as backdoors: it says GHOSTBLADE, unlike them, does not operate continuously, and GHOSTSABER has a command that changes the interval between its C2 check-ins.

Mitigation recommendations

  • Lockdown Mode: iVerify says these exploits would not be effective without additional bypasses where Lockdown Mode is active, or on the iPhone 17 with Memory Integrity Enforcement (MIE) enabled.
  • Hardware refresh: Lookout stresses “replacing older iOS device models” in organisations' mobile fleets.
  • Web filtering: block the indicators above in DNS, treating sqwas.shapelie[.]com as a subdomain only; GTIG says it added the DarkSword delivery domains to Safe Browsing.

Historical context and related activity

GTIG reported on 3 March 2026 that Coruna, an exploit kit for iOS 13.0 to 17.2.1 with five full chains and 23 exploits, was used first by a customer of a surveillance vendor, then by UNC6353 against Ukrainian users, and later by UNC6691, which GTIG calls a financially motivated threat actor operating from China. GTIG wrote that how this proliferation occurred is unclear but suggests an active market for “second hand” zero-day exploits. Its DarkSword post says the new chain's spread mirrors Coruna's.

Lookout says it found cdncounter[.]net while looking for domains tied to cdn.uacounter[.]com, which it notes Google had tied to UNC6353, and that the two share nameservers, a registrar and a registration date.

Future outlook

This section is assessment. GTIG assesses it is likely that other commercial surveillance vendors or threat actors “may also be using DarkSword”, and iVerify notes how easily these exploits can be deployed and repurposed. We assess that further use of DarkSword, or parts of it, against iOS 18 devices without Apple's fixes is likely (B2) in the coming months.

Further reading