Apple expands iOS 18.7.7 availability to protect more devices from DarkSword
Summary
Apple expanded iOS 18.7.7 availability so more devices staying on iOS 18 can receive protections against the actively exploited DarkSword kit. Researchers linked the kit to six CVEs and deployments of infostealers and backdoors.
Key points
- Apple says iOS 18.7.7 became available to more devices on April 1, 2026; users with Automatic Updates enabled can receive the protections automatically.
- DarkSword targeted iPhones running iOS 18.4 through 18.7 and used six tracked CVEs: CVE-2025-31277, CVE-2025-43529, CVE-2026-20700, CVE-2025-14174, CVE-2025-43510, and CVE-2025-43520.
- Google Threat Intelligence reported observing DarkSword use by PARS Defense, UNC6748, and suspected Russian espionage group UNC6353.
- Google Threat Intelligence observed GhostBlade, GhostKnife, and GhostSaber deployed on victims’ devices.
- The article says a public GitHub release of DarkSword last month increased access to the exploit kit, while some devices that stayed on iOS 18 had limited access to later security updates.
Article Details
- Event Type
- Apple expanded availability of iOS 18.7.7 to additional devices, providing security updates against the actively exploited DarkSword exploit kit.
- Impact
- DarkSword targeted iPhones running iOS 18.4 through 18.7 and was used to deploy the GhostBlade infostealer, GhostKnife backdoor, and GhostSaber malware on victims’ devices. The expansion allows more devices remaining on iOS 18 to receive protections; the article reports that a public GitHub release of the exploit kit increased the risk to older iPhones.
CVE
CVE-2025-14174Google · ChromeDarkSword leverages six tracked CVEs: CVE-2025-31277, CVE-2025-43529, CVE-2026-20700, CVE-2025-14174, CVE-2025-43510, and CVE-2025-43520.CVE-2025-31277Apple · iOS and iPadOS; Apple · macOS; +19 moreDarkSword leverages six tracked CVEs: CVE-2025-31277, CVE-2025-43529, CVE-2026-20700, CVE-2025-14174, CVE-2025-43510, and CVE-2025-43520.CVE-2025-43510Apple · iOS and iPadOS; Apple · macOS; +3 moreDarkSword leverages six tracked CVEs: CVE-2025-31277, CVE-2025-43529, CVE-2026-20700, CVE-2025-14174, CVE-2025-43510, and CVE-2025-43520.CVE-2025-43520Apple · iOS and iPadOS; Apple · macOS; +3 moreDarkSword leverages six tracked CVEs: CVE-2025-31277, CVE-2025-43529, CVE-2026-20700, CVE-2025-14174, CVE-2025-43510, and CVE-2025-43520.CVE-2025-43529Apple · iOS and iPadOS; Apple · macOS; +4 moreDarkSword leverages six tracked CVEs: CVE-2025-31277, CVE-2025-43529, CVE-2026-20700, CVE-2025-14174, CVE-2025-43510, and CVE-2025-43520.CVE-2026-20700Apple · iOS and iPadOS; Apple · macOS; +3 moreDarkSword leverages six tracked CVEs: CVE-2025-31277, CVE-2025-43529, CVE-2026-20700, CVE-2025-14174, CVE-2025-43510, and CVE-2025-43520.
Threat Actors
PARS DefenseThe article reports that the Turkish commercial surveillance vendor used the DarkSword exploit kit in attacks.UNC6353The article describes UNC6353 as a suspected Russian espionage group that used the DarkSword exploit kit.UNC6748The article identifies UNC6748 as a threat actor that used the DarkSword exploit kit.
Malware
GHOSTBLADEDarkSword abused six tracked CVEs and was used by actors such as PARS Defense, UNC6748, and UNC6353 to deploy infostealers and backdoors including GhostBlade, GhostKnife, and GhostSaber.GHOSTKNIFEDarkSword abused six tracked CVEs and was used by actors such as PARS Defense, UNC6748, and UNC6353 to deploy infostealers and backdoors including GhostBlade, GhostKnife, and GhostSaber.GHOSTSABERDarkSword abused six tracked CVEs and was used by actors such as PARS Defense, UNC6748, and UNC6353 to deploy infostealers and backdoors including GhostBlade, GhostKnife, and GhostSaber.
Vendors
AppleApple has expanded availability of iOS 18.7.7 so more devices running iOS 18 can receive security updates that protect against the actively exploited DarkSword exploit kit.PARS DefenseDarkSword abused six tracked CVEs and was used by actors such as PARS Defense, UNC6748, and UNC6353 to deploy infostealers and backdoors including GhostBlade, GhostKnife, and GhostSaber.
Products
iOS 18Apple has expanded availability of iOS 18.7.7 so more devices running iOS 18 can receive security updates that protect against the actively exploited DarkSword exploit kit.iOS 18.7.7Apple has expanded availability of iOS 18.7.7 so more devices running iOS 18 can receive security updates that protect against the actively exploited DarkSword exploit kit.iOS 26However, by late 2025, Apple stopped offering iOS 18 updates to newer devices capable of running the newer iOS 26.iPadSE (3rd generation), iPhone 14 (all models), iPhone 15 (all models), iPhone 16 (all models), iPhone 16e, iPad mini (5th generation – A17 Pro), iPad (7th generation – A16), iPad Air (3rd – 5th generation), iPad AiriPhoneSince then, only a small number of devices remained able to receive iOS 18 updates, and the last 18.7.6 update was offered only to iPhone XS, iPhone XS Max, and iPhone XR devices.