DarkSword: A State-Grade iOS Exploit Chain Spreads Across Threat Actors

In the ever-evolving landscape of mobile cybersecurity, a new and highly sophisticated piece of malware has emerged, targeting Apple's iOS ecosystem. Dubbed DarkSword by Google Threat Intelligence Group (GTIG), this full-chain exploit leverages multiple zero-day vulnerabilities to achieve complete device compromise. Since at least November 2025, the exploit has been observed in campaigns by both commercial surveillance vendors and state-sponsored actors, raising alarms due to its potency and rapid proliferation.

Discovery and Attribution

GTIG uncovered DarkSword during routine threat monitoring, identifying it as an iOS full-chain exploit that strings together several zero-day flaws. The name DarkSword was derived from toolmarks found in the recovered payloads. According to GTIG's analysis, the exploit chain has been actively used against targets in Saudi Arabia, Turkey, Malaysia, and Ukraine—a geographic spread that suggests a broad and well-resourced operational reach.

The researchers note that the exploit's sophistication points strongly to government-level development. The precision required to chain multiple zero-days and maintain reliability across diverse iOS versions indicates resources typically available only to nation-state actors or advanced commercial surveillance firms.

Technical Details of the Exploit Chain

Supported iOS Versions and Vulnerabilities

DarkSword supports iOS versions ranging from 18.4 through 18.7, a span that covers several major and minor releases. To achieve a full compromise, the exploit chain employs a total of six distinct vulnerabilities. While GTIG has not publicly disclosed the specific CVEs, the nature of the attack suggests a combination of kernel-level, memory corruption, and web browser exploits—allowing attackers to bypass even the most recent security protections.

Post-Exploitation Payloads

After a successful compromise, DarkSword deploys one of three known malware families: GHOSTBLADE, GHOSTKNIFE, and GHOSTSABER. Each payload appears designed for different operational objectives, such as data exfiltration, persistent access, or remote command execution. The modular payload design indicates that threat actors can customize the infection based on target profiles.

Threat Actors and Campaigns

Link to the Coruna iOS Exploit Kit

The proliferation of DarkSword across disparate groups mirrors the earlier spread of the Coruna iOS exploit kit. In fact, one notable actor—UNC6353, a suspected Russian espionage group—has been observed transitioning from Coruna to DarkSword in their watering hole campaigns. This shift suggests that DarkSword offers attackers either improved reliability or better evasion capabilities.

Commercial surveillance vendors, known for selling zero-day exploits to governments, have also incorporated DarkSword into their arsenal. The availability of such advanced tooling on the open market underscores the commoditization of offensive iOS capabilities.

Targeting and Geopolitical Implications

Victims have been identified in politically sensitive regions. The targeting of individuals in Saudi Arabia, Turkey, Malaysia, and Ukraine aligns with known espionage priorities of state-sponsored groups. In Ukraine, for example, the use of DarkSword may be part of ongoing cyber operations related to the conflict with Russia. In Malaysia and Turkey, the attacks could target dissidents, journalists, or government officials.

Leak and Broader Use

Approximately one week after GTIG first identified DarkSword, a version of the exploit chain leaked onto the internet. This leak dramatically expanded its availability, enabling a wider range of less sophisticated actors to deploy it. The rapid transition from controlled use to public availability mirrors past cases where advanced malware escaped into the wild, often leading to a spike in attacks until patches are applied.

GTIG's monitoring indicates that the leaked version has been actively incorporated into the toolkits of several new threat groups, further complicating defense efforts.

Mitigation and Safety

Despite the sophistication of DarkSword, users have a straightforward defense: regularly update iOS. The vulnerabilities exploited by DarkSword were patched by Apple in subsequent iOS releases following the chain's discovery. As of now—one month after the initial news—devices running iOS 18.8 or later are not vulnerable to these specific exploits.

Security experts recommend enabling automatic updates and promptly installing any security patches. Additionally, avoiding clicking on suspicious links or visiting untrusted websites reduces the risk of being targeted by watering hole campaigns.

Conclusion

DarkSword represents a significant escalation in the arms race between iOS security and attackers. Its discovery highlights the persistence of state-sponsored threats and the rapid spread of advanced exploit chains once they enter the public domain. While the current generation of exploits has been neutralized, the underlying techniques will likely be repurposed in future attacks. Staying vigilant and maintaining good patch hygiene remain the best defenses.