DarkSword malware planted on Ukraine.gov infrastructure leaves an estimated 220 million iPhones vulnerable, according to iVerify's threat research findings.

DarkSword Planted on Ukraine.gov Puts 220M iPhones at Risk

by
DarkSword iPhone spyware exploit kit cybersecurity threat
DarkSword chains six iOS vulnerabilities — three of them zero-days — into a single, invisible attack that hands attackers complete control of any unpatched iPhone — Generated by OpenAI DALL-E 3
💡 Key Takeaways

  • DarkSword is a full-chain iOS exploit kit that weaponizes six CVEs — including three zero-days — using only JavaScript, bypassing Apple’s core exploit mitigations in a single browser visit
  • Russia-aligned threat group UNC6353 deployed DarkSword via watering holes on Ukrainian government sites, including a domain ending in .gov.ua, stealing crypto wallets, emails, passwords, and real-time location data
  • iVerify estimates more than 220 million iPhones remain exposed; update to iOS 18.7.6 or iOS 26.3.1 immediately — all six CVEs are patched in those releases

Two hundred and twenty million. That is iVerify’s estimate of how many iPhones remain fully vulnerable to DarkSword, a newly discovered iOS exploit kit that chains six software flaws — three of them exploited as zero-days before Apple could patch them — into a silent, browser-triggered takeover. No malicious app download required. No unusual permission prompt. A single visit to a compromised website is all it takes.

The kit was not built by hobbyists. Russia-aligned espionage group UNC6353 used DarkSword in watering-hole attacks against Ukrainian targets beginning in November 2025, according to Mandiant researchers at Google Cloud. At least one compromised site carried a Ukrainian government domain — a .gov.ua address — meaning officials visiting their own government infrastructure were unknowingly handing over encrypted credentials, iCloud files, cryptocurrency wallet seeds, and GPS coordinates to a hostile intelligence service.

What makes this story more than a Ukraine-specific security incident is what came next. Turkey’s commercial surveillance firm PARS Defense and a separate threat cluster designated UNC6748 were also caught deploying the same exploit chain against targets in Saudi Arabia, Malaysia, and Turkey. DarkSword, it turns out, is not a state secret — it is, increasingly, a commercial product.

What Is DarkSword — The Six-Exploit Chain That Breaks iOS

DarkSword is a full-chain exploit kit — a modular attack framework that strings together multiple vulnerabilities so that each stage unlocks the next, ultimately delivering an attacker root-level control of the device. Mandiant, which named and analyzed the kit, identified six CVEs across critical iOS subsystems. Three of those were exploited as zero-days: CVE-2026-20700, a dyld pointer authentication code (PAC) bypass; CVE-2025-43529, a JavaScriptCore memory corruption flaw; and CVE-2025-14174, a memory corruption vulnerability in ANGLE, Apple’s graphics rendering layer.

The attack sequence proceeds in distinct stages. A compromised website serving the exploit triggers CVE-2025-43529 in the browser’s JavaScript engine, gaining initial code execution. The attacker then pivots through the GPU process to reach the system daemon mediaplaybackd via a WebGPU injection technique before exploiting CVE-2026-20700 to bypass the PAC — a hardware-level protection Apple introduced specifically to stop code-reuse attacks. Kernel memory flaws CVE-2025-43510 and CVE-2025-43520 then complete the privilege escalation chain, granting arbitrary read and write access to the device’s most protected memory regions.

The entire sequence runs in pure JavaScript. That architectural choice is not incidental — it allows DarkSword to sidestep two of iOS’s most important exploit mitigations: the Page Protection Layer (PPL) and the Secure Page Table Monitor (SPTM), both of which were designed to stop binary-level attacks. By keeping the exploit chain in the JavaScript sandbox until the final kernel stages, DarkSword avoids triggering the class of detector that looks for native code injection. Security researchers who analyzed DarkSword placed it alongside NSO Group’s Pegasus and Intellexa’s Predator as one of the most sophisticated iOS exploit chains to be publicly disclosed.

Russia’s Watering Hole: How Ukraine’s Own Government Sites Became the Trap

UNC6353 is a threat actor Mandiant characterizes as conducting operations aligned with Russian intelligence requirements, pursuing both espionage and financial objectives. The group’s first documented DarkSword activity dates to November 2025, placing it squarely inside the broader cyber dimension of the Ukraine conflict. Its chosen delivery mechanism — the watering hole — reflects a classic intelligence playbook: instead of attacking targets directly, poison the well they drink from.

The mechanics are straightforward and brutal. UNC6353 first identified websites regularly visited by Ukrainian officials, journalists, and civil servants — government portals, news platforms, institutional resources. It then compromised those sites, embedding the DarkSword exploit chain in their source code. Any iPhone user who loaded the page while running a vulnerable iOS version had their device silently exploited. iVerify’s analysis identified one confirmed watering-hole site bearing a .gov.ua domain, meaning the Ukrainian government’s own server infrastructure was actively participating in the attack against its own users.

The data pipeline activated within seconds to minutes of infection. Three malware families — codenamed GHOSTBLADE, GHOSTKNIFE, and GHOSTSABER — deployed in sequence, extracted their target data, and then deleted their traces. A Ukrainian security official, a military logistics coordinator, or a diplomat loading a routine government page might have had their entire digital identity replicated and exfiltrated before the page even finished rendering. They would see nothing unusual. There is no crash, no slowdown, no permission dialog.

cybersecurity threat watering hole attack iphone spyware
Watering-hole attacks compromise sites the target community trusts most — in UNC6353’s campaign, that included Ukrainian government infrastructure — Photo by Jefferson Santos on Unsplash

GHOSTBLADE, GHOSTKNIFE, GHOSTSABER — What They Steal and How They Disappear

The three malware families deployed by DarkSword each serve a discrete function in the post-exploitation pipeline. GHOSTBLADE is the primary data harvester. Once installed, it accesses privileged processes to extract a broad sweep of personal data: emails, iCloud-synced files, stored passwords, SMS messages, browser history, location data, and app-specific information. The extraction completes within seconds to minutes, after which GHOSTBLADE removes its own artifacts — forensically, the device looks clean.

GHOSTKNIFE is a JavaScript backdoor purpose-built for cryptocurrency and credential theft. It targets wallet seed phrases, transaction histories, and authentication tokens stored on the device. Given that high-value targets — diplomats, intelligence operatives, activists — increasingly use mobile wallets, the inclusion of a dedicated crypto-theft module suggests UNC6353 is pursuing financial returns alongside espionage. GHOSTSABER handles persistent device enumeration and maintains an ongoing exfiltration channel, allowing the attacker to continue pulling data after the initial burst without re-triggering the exploit chain.

All three modules are implemented in pure JavaScript. This is technically significant: it means the malware never needs to write native binaries to disk, avoiding the signature-based detection that endpoint security tools rely on. The combination of rapid extraction, trace deletion, and JavaScript-only execution creates a threat profile that is genuinely difficult to detect after the fact — and nearly impossible to notice in real time.

💡 Related Posts
Siri Still Broken in iOS 26.4 — Is Gemini Taking Over Apple’s AI?

Not Just for State Spies — Turkey’s PARS Defense Is Selling the Same Kit

The Ukraine campaign would be alarming enough in isolation. What elevates DarkSword to a systemic problem is the breadth of actors using it. According to analysis from SecurityWeek and Mandiant, Turkey-based commercial surveillance vendor PARS Defense sold access to the DarkSword exploit chain to customers who ran at least two separate campaigns: one targeting users in Turkey and a second targeting users in Malaysia, both active in late 2025 and early 2026. A separate threat cluster, UNC6748, deployed the kit against targets in Saudi Arabia, also in November 2025.

The pattern mirrors what the world saw with NSO Group’s Pegasus and Intellexa’s Predator. A sophisticated exploit chain — in those cases developed or acquired by a commercial surveillance firm — gets licensed to government clients across multiple countries. The vendor earns revenue; the clients get deniable surveillance capability; and the people targeted have no recourse because the attack leaves no trace. DarkSword’s confirmed victims span at least four countries: Ukraine, Saudi Arabia, Turkey, and Malaysia. The real number is likely higher.

The implications for the broader mobile security ecosystem are substantial. Apple’s security architecture was designed assuming that a sophisticated attacker would need to invest enormous resources to develop a working iOS exploit chain — resources that would constrain how broadly the tool could be deployed. The commercial-surveillance-as-a-service model breaks that assumption. Once the initial development cost is amortized across multiple government clients, the marginal cost of each new deployment approaches zero.

mobile phone security surveillance spyware threat
Commercial surveillance vendors like PARS Defense effectively license nation-state-grade spyware to government clients worldwide, lowering the barrier to sophisticated mobile attacks — Photo by Andre DM on Unsplash

220 Million iPhones Still Exposed — The Patch Gap That Keeps Attackers Employed

Apple responded to DarkSword’s disclosure by patching all six CVEs. CVE-2025-31277 and CVE-2025-43529 were addressed in iOS 26.1 and iOS 26.2 respectively; CVE-2026-20700 and the remaining privilege-escalation vulnerabilities were closed in iOS 26.3. The complete fix is available in iOS 18.7.6 and iOS 26.3.1, both of which Apple has already released. On paper, the threat is neutralized for anyone running those versions.

In practice, iVerify estimates that approximately 14.2% of iPhone users are still running iOS versions between 18.4 and 18.6.2 — a population the firm calculates at more than 220 million devices globally. These are not obscure legacy devices. They include iPhones that shipped with recent iOS versions and simply haven’t been updated, often because the owner disabled automatic updates, never received a prompt, or made a conscious choice to defer the update. Every one of those devices remains fully exploitable by DarkSword’s unpatched attack chain.

The data that can be extracted from a compromised device is comprehensive enough to constitute a complete identity theft: all stored emails, every iCloud-synced file, every saved password in the iOS keychain, complete SMS history, full browser history across all tabs and windows, real-time GPS location, cryptocurrency wallet seed phrases and transaction records, and any data stored in third-party apps accessible through elevated process permissions. An attacker who captures this dataset can impersonate the victim across virtually every digital platform, drain their cryptocurrency holdings, and track their physical location in real time — all without the victim ever knowing their device was touched.

💡 Related Posts
OpenAI Pentagon Deal Backfires: Hardware Lead Quits, ChatGPT Uninstalls +295%

Is Your iPhone Safe? What to Do Right Now

The fix is unambiguous: open Settings → General → Software Update and verify that your device is running iOS 18.7.6 or iOS 26.3.1 or later. If an update is available, install it now. If your device shows it is already up to date but you are uncertain which version it is running, check the version number directly in Settings → General → About. Any version below iOS 18.7.6 in the iOS 18 family, or below iOS 26.3.1 in the iOS 26 family, is vulnerable to DarkSword’s complete attack chain.

For users who want to verify whether their device was compromised before the patch was applied, iVerify offers a mobile threat detection application that can scan for indicators of compromise. This is particularly relevant for high-risk individuals: government officials, journalists, human rights advocates, legal professionals handling sensitive cases, and anyone else who might reasonably be a target of state-sponsored or commercially procured surveillance. The watering-hole delivery mechanism means that infection requires only a visit to a trusted website — not clicking a suspicious link or downloading an unfamiliar file.

Organizations with mobile device management (MDM) deployments should audit their fleet immediately for devices still running vulnerable iOS versions and push the update through their MDM console. For enterprises that have delayed the iOS 26 migration, iOS 18.7.6 remains a fully supported update that patches all six DarkSword CVEs without requiring a major version upgrade.

iOS security update spyware protection mobile device
Updating to iOS 18.7.6 or 26.3.1 closes all six DarkSword attack vectors — the patch is available now, and the cost of not applying it is total device compromise — Photo by Rohan on Unsplash

Why Mobile Became the New Front Line of Cyberwar

A compromised smartphone delivers intelligence value that no other single device can match. It carries real-time location, financial accounts, communication metadata, personal contacts, health records, and access credentials to an individual’s entire professional infrastructure. Owning someone’s iPhone, in the intelligence trade, is functionally equivalent to owning that person. Advanced persistent threat (APT) groups have recognized this reality for years; DarkSword is the latest evidence that they are investing accordingly.

The structural dynamic driving the proliferation of tools like DarkSword is worth understanding clearly. Governments invest heavily in developing or acquiring zero-day vulnerabilities. Those vulnerabilities are sometimes retained for exclusive state use, but increasingly they flow into commercial surveillance firms — NSO Group, Intellexa, and now apparently PARS Defense — which license them to client governments at scale. The economics work in the attacker’s favor: the development cost is fixed, the marginal cost of each new deployment is near zero, and the targets — most of whom do not apply patches promptly — remain vulnerable for months after the original exploit was discovered.

Apple’s security architecture has improved substantially over the past decade, and DarkSword’s authors went to considerable technical lengths to circumvent it. But the more important metric is not whether Apple can eventually patch these vulnerabilities — it demonstrably can — but whether users apply those patches before attackers exploit the window of exposure. With 220 million devices still running vulnerable software weeks after patches became available, that window remains wide open. Two indicators will define what happens next: the speed at which UNC6353 sources its next zero-day chain post-patch, and whether U.S. and EU sanctions targeting PARS Defense and similar commercial surveillance vendors produce any meaningful deterrent effect on the supply side of this market.

References

Stay Ahead of the Curve

Get the latest insights on AI, tech, and markets — delivered in both Korean and English.

Explore More Posts