Censys Finds Live DarkSword/Coruna Infrastructure and iOS Wallet-Theft Platform

Oct 7, 2026 · Original article ↗

Summary

Censys uncovered live DarkSword/Coruna infrastructure, iOS wallet-theft modules, and evidence of a distinct Chinese-speaking operator. An iOS 26 exploit chain is under development but not deployed.

Key points

Five exposed hosts contained DarkSword/Coruna deployment materials; telemetry showed two iOS devices repeatedly beaconing to an operational host.
A production-server copy contained 11 wallet recovery phrases, 179 device loot directories, and a 75-account agent/reseller roster.
The implant targets crypto wallets and can extract valid recovery phrases from photos and Notes; researchers found 18 wallet modules, plus a BitKeep module in wild samples.
Researchers attribute the infrastructure to a Chinese-speaking operator distinct from previously tracked DarkSword actors, but could not identify the operator by name.
The operator is developing a JavaScriptCore exploit for iOS 26, CVE-2026-31001; the chain is unfinished and has not been deployed.
Censys produced 44 YARA rules covering the analyzed DarkSword/Coruna binaries, with matches across all 347 unique Mach-O samples in the set.

Article Details

Attack Vectors: DarkSword exploits WebKit and JavaScriptCore in an iOS browser session, then escapes the browser sandbox and escalates to kernel privileges.
A watering-hole page lures victims to a page containing exploit code; the implant checks in while the page remains open.
The SpringBoard coordinator injects wallet-specific modules into running wallet processes. The implant also searches photos and Notes for recovery phrases and collects address-book data.
The gooll chain targets iOS 13.0 through 17.2.1 with a runtime-adaptive kernel stage; the article says its vulnerabilities cannot be identified from the binaries alone.
Wild-build wallet modules use hxxps://66ds[.]lol as a hardcoded C2, while other operator builds use separate C2 infrastructure.
Defensive Notes: The article says the 18.x chains are patched in iOS 18.7.3 and 26.3; it cautions that the iOS 26 chain is unfinished and not fielded.
The reported 44-rule YARA signature set matched all 347 unique Mach-O binaries in the sample set, with zero matches in a sweep of several thousand legitimate macOS binaries.
The report recommends tracking staging hosts and panel signatures rather than individual domains, which it says churn faster.
The article identifies closing port 9999 on 166.88.95[.]90 and port 8080 on 156.239.230[.]120 as measures that would deny the operator C2 and telemetry.

Indicators of compromise

Type	Indicator	Context
DOMAIN	`66ds[.]lol`	Hardcoded C2 domain in 22 wild-build wallet-module samples.
DOMAIN	`escofiringbijou[.]com`	C2 domain IOC cited for the earlier DarkSword campaign referenced in the article.
DOMAIN	`fc[.]rsqqq[.]top`	Domain associated with the operator's backup delivery stack.
DOMAIN	`hdios[.]cn`	Domain of the live production server hosting the operator's kit and C2.
DOMAIN	`i[.]131422[.]com`	Domain associated with the operator's former production server.
DOMAIN	`iplcz[.]cn`	Operator-associated domain resolving to the wild-build C2 origin and identified as the IPLCZ Test Lab front.
DOMAIN	`northlab[.]cn`	Operator lab domain linked to the wild-build C2 operator through certificate hostnames.
DOMAIN	`siekeltd[.]com`	Payload domain IOC cited for the earlier DarkSword campaign referenced in the article.
DOMAIN	`st[.]onlinefc[.]top`	Domain listed for the operator work-machine host.
HOSTNAME	`g[.]northlab[.]cn`	Operator management hostname disclosed by the origin server's certificate.
HOSTNAME	`manager[.]g[.]northlab[.]cn`	Operator management hostname disclosed by the origin server's certificate.
IPV4	`101[.]35[.]158[.]183`	Origin server behind the wild-build C2, presenting the operator's private self-signed certificate.
IPV4	`112[.]213[.]108[.]85`	Live production server hosting the operator's DarkSword/Coruna kit and C2.
IPV4	`14[.]128[.]47[.]81`	Separate deployment of the group-named C2 control panel.
IPV4	`154[.]18[.]187[.]160`	Backup delivery-stack host associated with the operator infrastructure.
IPV4	`154[.]217[.]250[.]206`	Host serving a DarkSword-associated C2 control panel.
IPV4	`156[.]239[.]230[.]120`	Live DarkSword/Coruna C2 platform and exploit-delivery host.
IPV4	`166[.]88[.]95[.]90`	Operational C2 host with an active beacon and victim telemetry.
IPV4	`185[.]189[.]45[.]40`	Host whose captured directory contained DarkSword/Coruna payloads.
IPV4	`202[.]146[.]222[.]253`	Former production server identified in the package as the operator's old server.
IPV4	`203[.]91[.]77[.]253`	Operator work-machine host listed in the report's infrastructure table.
IPV4	`218[.]25[.]85[.]177`	Operator lab and mail infrastructure associated with the northlab[.]cn domain.
IPV4	`218[.]25[.]85[.]178`	Operator lab and mail infrastructure associated with the northlab[.]cn domain.
IPV4	`23[.]148[.]212[.]237`	Operator analysis workstation containing DarkSword development files.
IPV4	`43[.]134[.]165[.]205`	Host serving the DS-Fusion bundle containing the Coruna payload tree.
IPV4	`47[.]102[.]192[.]23`	Coruna staging host carrying Stage1, Stage2, and per-victim payload directories.
IPV4	`59[.]46[.]4[.]117`	Operator lab and mail infrastructure associated with the northlab[.]cn domain.
IPV4	`59[.]46[.]4[.]119`	Operator lab and mail infrastructure associated with the northlab[.]cn domain.
SHA1	`1334417664270db20af705f422878c53c8378203`	Coruna payload-module hash reported as byte-identical across multiple operator captures.
SHA256	`54a4166ab33ffe02b41de9c943e783d20129b6cc22f56b7fe7d564fd02bde006`	SHA-256 of core_a5.dylib, the production plasma_core implant.
SHA256	`7ff5bb16cd5f8c92bc4fec72bba162662f202af075418db5000a1b4f81489fc2`	SHA-256 of future-destroy.htm, the SpringBoard injection coordinator.
SHA256	`864d68e64618d6bfc26d75d6f780ae0b7bfed3698cc8333818ed32519e560d1f`	Unique body hash of the operator-associated C2 control-panel deployment at 154.217.250[.]206.
SHA256	`8973e80ab494c02463d4123f76fc5e2dca2ea2c097317d246323d75c1f2eb791`	SHA-256 of stage2.dylib, the plasma stage-2 controller.
SHA256	`a50c4da5c92636b2b1f170cdce3bd967a213886a8df5656cf3519214fcecfac5`	SHA-256 of core_v6.dylib, the plasma_core implant lab build.
SHA256	`c391bce7b09a0ea263e4b2c1d1bde0327c180723fa3299b006485429564c61ee`	SHA-256 of bootstrap.dylib, the stage-0 beacon.
URL	`hxxp[:]//199[.]30[.]90[.]154:18090`	Hardcoded fallback C2 URL in the plasma implant.
URL	`hxxps[:]//66ds[.]lol`	Hardcoded C2 URL in 22 wild-build wallet-module samples.