cyber.hendryadrian.com
Threat Research · cloud.google.com

Google Details DarkSword iOS Exploit Chain Used by Multiple Threat Actors

· Original article ↗

Summary

Google’s GTIG details DarkSword, a JavaScript iOS exploit chain abusing six vulnerabilities to gain kernel privileges, and its use by commercial surveillance vendors and suspected state actors to deploy three payload families. Apple patched the flaws; GTIG advises users

Key points

  • GTIG reports that DarkSword targets iOS 18.4–18.7 and chains six vulnerabilities, including multiple zero-days, to gain kernel privileges.
  • The exploit progresses from remote code execution in JavaScriptCore through two sandbox escapes to a kernel privilege-escalation stage.
  • GTIG observed use by UNC6748, PARS Defense and a customer, and suspected Russian espionage group UNC6353 in campaigns targeting users in Saudi Arabia, Turkey, Malaysia, and Ukraine.
  • The three identified payload families are GHOSTBLADE, a data-collecting implant; GHOSTKNIFE, a backdoor with data theft and device-monitoring capabilities; and GHOSTSABER, a backdoor that can execute JavaScript.
  • Operators adapted delivery code with techniques including obfuscation, device fingerprinting, and version-specific exploit loading.
  • Apple patched the vulnerabilities in iOS releases; GTIG recommends updating devices or enabling Lockdown Mode when an update is not possible.

Article Details

Attack Vectors
  • Drive-by and watering-hole campaigns used malicious or compromised websites to load JavaScript iframes and fetch DarkSword exploit stages.
  • DarkSword targeted iOS 18.4–18.7, chaining JavaScriptCore remote-code-execution vulnerabilities, sandbox escapes, a dyld PAC bypass, and kernel vulnerabilities to obtain kernel privileges.
  • Some delivery implementations used obfuscation, anti-debugging, device fingerprinting, sessionStorage checks, and encrypted loader or exploit fetches.
  • Post-exploitation payloads collected and exfiltrated device data; GHOSTKNIFE and GHOSTSABER also supported backdoor functions.
Defensive Notes
  • Update iOS to the latest version; Apple patched the vulnerabilities across iOS 18.6–18.7.3 and 26.x releases, with all addressed by iOS 26.3.
  • Enable Lockdown Mode if updating is not possible.
  • Google added DarkSword delivery domains to Safe Browsing and provided YARA rules for detection.
  • GTIG notified and collaborated with CERT-UA to mitigate the Ukrainian watering-hole activity.

Indicators of compromise

TypeIndicatorContext
DOMAINe5[.]malaymoil[.]comDarkSword delivery domain used in activity targeting users in Malaysia.
DOMAINsahibndn[.]ioDarkSword delivery domain associated with PARS Defense activity in Turkey.
DOMAINsnapshare[.]chatDarkSword delivery domain used by UNC6748 to target users in Saudi Arabia.
DOMAINsqwas[.]shapelie[.]comReported GHOSTBLADE exfiltration server.
DOMAINstatic[.]cdncounter[.]netUNC6353 delivery server used to load DarkSword in watering-hole activity targeting Ukrainian users.
IPV462[.]72[.]21[.]10Reported GHOSTKNIFE C2 server observed in November 2025.
IPV472[.]60[.]98[.]48Reported GHOSTKNIFE C2 server observed in November 2025.
SHA2562e5a56beb63f21d9347310412ae6efb29fd3db2d3a3fc0798865a29a3c578d35SHA-256 of an extracted GHOSTBLADE sample uploaded to VirusTotal.

MITRE ATT&CK

T1027 · Obfuscated Files or InformationSome operators obfuscated the exploit loader and exploit stages.T1041 · Exfiltration Over C2 ChannelGHOSTBLADE exfiltrated collected device data to an attacker-controlled server over HTTP(S).T1068 · Exploitation for Privilege EscalationThe final exploit stage used CVE-2025-43520 to obtain kernel memory read/write primitives and elevate privileges.T1070.004 · File DeletionGHOSTKNIFE and GHOSTBLADE deleted crash logs or diagnostic reports from infected devices.T1071 · Application Layer ProtocolGHOSTKNIFE communicated with its C2 over HTTP using a custom binary protocol; the payloads also used HTTP(S) for communications.T1105 · Ingress Tool TransferJavaScript loaders fetched additional exploit stages and payloads; GHOSTKNIFE also supports downloading files from its C2 server.T1189 · Drive-by CompromiseDarkSword was delivered through drive-by and watering-hole campaigns, including malicious scripts loaded from compromised Ukrainian websites.T1203 · Exploitation for Client ExecutionJavaScriptCore vulnerabilities CVE-2025-31277 and CVE-2025-43529 were exploited for remote code execution in Safari.

CVE

CVE-2025-14174Google · ChromeThis exploit leverages CVE-2025-14174, a vulnerability in ANGLE where parameters were not sufficiently validated in a specific WebGL operation, leading to out-of-bounds memory operations in Safari’s GPU process whichCVE-2025-31277Apple · iOS and iPadOS; Apple · macOS; +19 moreusing CVE‑2025‑31277 and CVE‑2025‑43529 to achieve initial code execution (‘leveraged CVE-2025-31277, a memory corruption vulnerability in JavaScriptCore’).CVE-2025-43510Apple · iOS and iPadOS; Apple · macOS; +3 moreTo bypass this limitation, DarkSword uses another sandbox escape exploit, sbx1_main.js, which leverages CVE-2025-43510, a memory management vulnerability in XNU.CVE-2025-43520Apple · iOS and iPadOS; Apple · macOS; +3 moreto build arbitrary physical/virtual memory read/write primitives (‘pe_main.js… uses CVE-2025-43520, a kernel-mode race condition in XNU’s virtual filesystem (VFS) implementation’).CVE-2025-43529Apple · iOS and iPadOS; Apple · macOS; +4 moreThis exploit used CVE-2025-43529, a different memory corruption vulnerability in JavaScriptCore, alongside the same CVE-2026-20700 exploit in the same file.CVE-2026-20700Apple · iOS and iPadOS; Apple · macOS; +3 morevulnerability in JavaScriptCore (the JavaScript engine used in WebKit and Apple Safari), and also CVE-2026-20700, a Pointer Authentication Codes (PAC) bypass in dyld.

Threat Actors

PARS DefenseGTIG associated DarkSword campaigns targeting users in Turkey and Malaysia with PARS Defense and a customer, respectively; the article identifies PARS Defense as a commercial surveillance vendor.UNC6353GTIG describes UNC6353 as a suspected Russian espionage actor and observed it using DarkSword to deploy GHOSTBLADE in watering-hole activity targeting Ukrainian users.UNC6748GTIG observed this threat cluster using DarkSword delivery pages and deploying GHOSTKNIFE against users in Saudi Arabia.

Malware

GHOSTBLADE(including multiple zero‑days) to achieve kernel privileges and deliver post‑exploitation payloads GHOSTBLADE, GHOSTKNIFE, and GHOSTSABER against targets in Saudi Arabia, Turkey, Malaysia, and Ukraine.GHOSTKNIFEmultiple zero‑days) to achieve kernel privileges and deliver post‑exploitation payloads GHOSTBLADE, GHOSTKNIFE, and GHOSTSABER against targets in Saudi Arabia, Turkey, Malaysia, and Ukraine.GHOSTSABERto achieve kernel privileges and deliver post‑exploitation payloads GHOSTBLADE, GHOSTKNIFE, and GHOSTSABER against targets in Saudi Arabia, Turkey, Malaysia, and Ukraine.

Vendors

AppleGTIG reported the vulnerabilities to Apple; patches were released in iOS 18.6–18.7.3/26.x series and users are urged to update or enable Lockdown Mode if unable to update.GoogleGoogle Threat Intelligence Group (GTIG) disclosed DarkSword, a JavaScript-based iOS full‑chain exploit that chained six vulnerabilities (including multiple zero‑days) to achieve kernel privileges and deliverPARS Defensemultiple commercial surveillance vendors and suspected state actors (including UNC6353, UNC6748, and PARS Defense), published mitigation guidance, and added delivery domains to Safe Browsing.

Products

iOSGoogle Threat Intelligence Group (GTIG) disclosed DarkSword, a JavaScript-based iOS full‑chain exploit that chained six vulnerabilities (including multiple zero‑days) to achieve kernel privileges and deliverSafari[T1203 ] Exploitation for Client Execution – Remote code execution in Safari/JavaScriptCore using CVE‑2025‑31277 and CVE‑2025‑43529 to achieve initial code execution (‘leveraged CVE-2025-31277, a memory

Tools

DarkSwordGoogle Threat Intelligence Group (GTIG) disclosed DarkSword, a JavaScript-based iOS full‑chain exploit that chained six vulnerabilities (including multiple zero‑days) to achieve kernel privileges and deliver

Countries

Malaysiapayloads GHOSTBLADE, GHOSTKNIFE, and GHOSTSABER against targets in Saudi Arabia, Turkey, Malaysia, and Ukraine.Saudi Arabiaand deliver post‑exploitation payloads GHOSTBLADE, GHOSTKNIFE, and GHOSTSABER against targets in Saudi Arabia, Turkey, Malaysia, and Ukraine.Turkeypost‑exploitation payloads GHOSTBLADE, GHOSTKNIFE, and GHOSTSABER against targets in Saudi Arabia, Turkey, Malaysia, and Ukraine.Ukrainepayloads GHOSTBLADE, GHOSTKNIFE, and GHOSTSABER against targets in Saudi Arabia, Turkey, Malaysia, and Ukraine.

Related Articles