CISA recently ordered all U.S. government agencies to patch three critical vulnerabilities in iOS that have been targeted for cryptocurrency theft and espionage attacks via the DarkSword exploit kit . The move comes after warnings published by researchers at Google Threat Intelligence Group (GTIG) and iVerify , who analyzed the framework.
What is DarkSword and how it works
DarkSword is an advanced delivery framework that exploits a chain of six vulnerabilities, listed as CVE-2025-31277, CVE-2025-43529, CVE-2026-20700, CVE-2025-14174, CVE-2025-43510, and CVE-2025-43520 . These vulnerabilities allow attackers to bypass sandboxes, escalate privileges, and execute remote code on unpatched iPhones. The latest versions of iOS have already patched these vulnerabilities , limiting the threat to devices running iOS 18.4 through 18.7.
Security researchers have linked DarkSword to multiple threat groups, including UNC6748 and a suspected Russian espionage group, UNC6353. The kit is used for targeted attacks, including attacks watering-hole, where users are lured to compromised websites and infected without realizing it.
See also: Magento: PolyShell vulnerability allows RCE and account theft
Malware associated with DarkSword
GTIG identified three main malware families used via DarkSword. GhostBlade is an aggressive JavaScript-based information-stealing program . GhostKnife acts as a backdoor , allowing large amounts of data to be extracted, while GhostSaber executes code and steals information from victims.
UNC6353 appears to have developed both DarkSword and Coruna, using compromised Ukrainian e-commerce, industrial equipment, and local service provider websites to attack iPhone users. Notably, DarkSword deletes temporary files after data is stolen, suggesting it was designed for short, discreet espionage operations.
Cyber espionage campaigns and economic motives
Mobile security firm Lookout, which discovered DarkSword while investigating the infrastructure used in the Coruna attacks, claims that DarkSword is being used in campaigns cyberespionage aligned with Russian intelligence agencies. It also appears to be used for financial purposes, suggesting a dual motive for the attacks: espionage and financial exploitation.
See also: Quest KACE SMA: Hackers exploit critical vulnerability
The response of CISA and the obligations of the services
On Friday, CISA added three of the six DarkSword vulnerabilities to its list of actively exploited vulnerabilities: CVE-2025-31277, CVE-2025-43510, and CVE-2025-43520. Federal agencies were ordered to secure their devices by April 3, per Binding Operational Directive BOD 22-01.
Advice for businesses and individuals
Although BOD 22-01 only applies to federal agencies, CISA recommended that all organizations, public and private, prioritize the security of their iPhones. Failure to update devices in a timely manner poses serious risks, as such vulnerabilities are often used by malicious users for targeted attacks.
See also: Apple: Old iPhones vulnerable to Coruna and DarkSword exploits
CISA’s warning and GTIG and iVerify’s analysis highlight the ongoing threat posed by advanced exploit kits like DarkSword. Staying up-to-date and implementing security measures is critical, not only for government agencies but for any organization that wants to protect its data and infrastructure from global malicious actors. The era of mobile cybersecurity requires constant vigilance and a strategic approach to advanced threats.
Source: www.bleepingcomputer.com
🔒 Protect your privacy with Proton VPN
Swiss VPN from the creators of Proton Mail — strict no-logs policy, strong encryption, and built-in NetShield that blocks ads, trackers, & malware.
- ✔ No-logs, based in Switzerland (except 14-Eyes)
- ✔ NetShield: blocks ads, trackers & malicious domains
- ✔ Covers all devices — free version available
The link is an affiliate link — SecNews may receive a commission at no additional cost to you. It does not affect the independence of our article writing.
