threat-intel
Chinese Threat Actor Uses Leaked DarkSword Kit to Deploy GHOSTBLADE on iOS
High
Summary
A Chinese threat actor is leveraging a publicly leaked version of the DarkSword exploit kit to deploy GHOSTBLADE, an information-stealing malware, targeting Apple iOS devices. Censys identified over 100 web properties used in the campaign, primarily mimicking AWS sign-in pages and hosting various exploit panels. The attack leverages watering holes and a leaked source code, with evidence suggesting the use of both DarkSword and Coruna exploit kits, potentially linked to UNC6353 and targeting Ukrainian users.
Summary written automatically in our own words from the original article, which belongs to its publisher and remains the reference. It may contain errors. Sources & data