Skip to content

DarkSword / GHOSTBLADE iOS exploit infrastructure

Summary

Censys ARC documented a fast-changing, Chinese-speaking infrastructure cluster operating the leaked DarkSword iOS exploit chain across more than 100 web properties. The cluster combines fake AWS, Apple ID, Chinese service, and media lures with exploit staging, multiple operator-panel builds, credential harvesting, and GHOSTBLADE modules that collect keychain, iCloud, Wi-Fi, and file data.

DarkSword is a six-vulnerability full-chain exploit for iOS 18.4 through 18.7. Google Threat Intelligence Group (GTIG) first described its use by multiple unrelated actors, including commercial-surveillance customers and suspected state-sponsored groups. Censys assesses the newly profiled cluster as another operator using the publicly leaked kit; the infrastructure overlap does not attribute it to GTIG clusters such as UNC6353 or UNC6748.

Tags

Why this matters

  • A leaked high-end mobile exploit chain has moved beyond its earlier users into at least seven, and probably eight, unrelated operator sets. Capability proliferation makes actor attribution from exploit use alone unreliable.
  • Censys observed 27 hosts and 180 labeled web properties on 2026-07-30. The hosts and domains changed within days, while HTTP response-body hashes remained stable enough for durable hunting.
  • The campaign blends exploit delivery with credential phishing. One Hong Kong host served both an Apple ID decoy and DarkSword staging, so a failed exploit does not necessarily mean the victim's account credentials were safe.
  • Censys found one now-offline Singapore host running DarkSword and Coruna panels together. That is evidence of multi-kit operation, not proof that every DarkSword or Coruna deployment belongs to the same actor.

Observed attack chain

  1. A victim reaches an AWS-console impersonation, Apple ID sign-in page, iOS-themed lure, or another actor-controlled web property.
  2. The site serves a stable DarkSword staging page and loads frame.html in a hidden iframe.
  3. frame.html retrieves version-dispatch logic such as rce_loader.js, which selects exploit workers according to the reported iOS version.
  4. DarkSword chains WebKit/JavaScriptCore code execution, a PAC bypass, sandbox escape, and privilege escalation against supported iOS 18.4–18.7 devices.
  5. Successful exploitation deploys GHOSTBLADE modules including ghostblade.js, keychain_copier.js, icloud_dumper.js, wifi_password_securityd.js, and file_downloader.js.
  6. The implant sends collected data to /stats or /upload endpoints associated with one of several operator panels.
  7. The operator retrieves data through a DarkSword Admin, Decode Dashboard, or C2 Control Panel interface.
  8. The implant deletes crash reports and RemoteLog.log, adjusts memory pressure, and exits.

GTIG identifies the six DarkSword vulnerabilities as CVE-2025-31277, CVE-2025-43529, CVE-2026-20700, CVE-2025-14174, CVE-2025-43510, and CVE-2025-43520. Apple fixed the complete chain by iOS 26.3, with several components fixed earlier.

Infrastructure findings

Scale and churn

Censys reported these distinct but related measurements:

  • 27 hosts and 180 web properties carried the DarkSword threat label on 2026-07-30.
  • A separate April scan collected files from 100 web properties for code and deployment comparison.
  • The DarkSword Admin login-body hash matched seven hosts across Hong Kong, Japan, and the United States on ports 3000, 8443, and 8888.
  • Five of those seven hosts were new compared with the prior week, while the page body remained unchanged.
  • Of the 100 April web properties, 49 returned no known core-chain files at collection time. Treat them as lure or staging pivots, not proof that every visit received an exploit.

Shared code, varying delivery

Censys found one SHA-256 value each across the collected copies of the staging index.html, ghostblade.js, keychain_copier.js, wifi_password_securityd.js, icloud_dumper.js, and file_downloader.js. Version-dependent components varied more: frame.html had 10 builds and rce_loader.js had 14.

Two composite chain fingerprints covered 63 of the 100 web properties. This supports a common leaked codebase deployed through a small number of build profiles, while preserving room for modified variants and unrelated users of the same public kit.

Multi-panel and multi-kit operation

A Singapore host, 38.181.52[.]95, briefly exposed three DarkSword-related interfaces, a Coruna administration panel, an iOS exploit dashboard, a MinIO console, MySQL, and STUN services. It was no longer in the live Censys set by July 30.

The coexistence of Coruna and DarkSword is operationally important because UNC6353 previously moved from Coruna to DarkSword. It is not enough to connect this Chinese-speaking cluster to UNC6353: leaked or traded exploit frameworks can be shared by unrelated actors.

Operator mistakes

  • 103.106.190[.]217 co-hosted DarkSword staging, a C2 Control Panel, and an Apple ID credential-harvesting page.
  • The panel displayed the name 亚太集团 (“Asia-Pacific Group”) and a Telegram contact at t[.]me/YATA0000.
  • An open directory on 93.152.221[.]37:9999 exposed .bash_history, .ssh/authorized_keys, cached ffuf configuration, and the SSH-key comment jkcing@apt.
  • The same German host also exposed a separately named Thorn C2 panel on port 443.

These are cluster pivots, not verified legal identities.

Public hunt pivots

Infrastructure is highly volatile. Prefer body hashes and behavior over static IP-only blocking.

HTTP response-body SHA-256

  • DarkSword staging page: 50582f8d52e49f549615ec7cd68629b9f939a0cfc5c5408f324b2f1cff070e99
  • DarkSword Admin panel: 46a0bd09f145ab909e5bf45fafe906f452f06971bd227653f0c52af8e22da89e
  • Decode Dashboard panel: 3c37835766ca615f5eb0e766b4000b43e896a420d575f02e1e160be5711e0782
  • C2 Control Panel: 273df85db2d449bbf32a44848877b07b417667eb96481ce37e46bf04dd6cc222
  • Apple ID decoy: d37b6198034995b8642f78706e197b3ead3cdf125d7f9cf47a60dc7f9b8ef789

Current or recently observed infrastructure

  • 38.22.89[.]117:8888
  • 103.97.128[.]67:8888
  • 162.4.136[.]30:8888
  • 223.26.63[.]56:8888
  • 151.243.126[.]191:8443 and :8888
  • 107.175.49[.]181:3000
  • 103.238.129[.]112:3000
  • 103.226.155[.]200
  • 103.226.155[.]201
  • 202.8.120[.]249
  • 103.106.190[.]217
  • 93.152.221[.]37:9999
  • se006[.]vip
  • ng28jt[.]xyz
  • historical loader domain: static.cdncounter[.]net (reported parked after registrar action)

The PCCW Decode Dashboard cluster exposed a five-port pattern: 8000, 8881, 8882, 8888, and 9999. Censys also identifies jkonnet[.]buzz, tronide[.]cc, myymk[.]cc, ytl99[.]vip, and dcgfun[.]top as high-count base domains in its July 30 snapshot. Revalidate all network indicators before action.

Defender actions

  1. Update supported iPhones and iPads to the latest available OS. DarkSword's complete chain was fixed by iOS 26.3. Devices that cannot be updated should not be treated as safely mitigated by browser choice alone.
  2. Enable Lockdown Mode for high-risk users where operationally acceptable, especially people targeted by commercial surveillance, state espionage, or mobile watering holes.
  3. Hunt web and proxy telemetry for the staging and panel body hashes, hidden frame.html loading, rce_loader.js, the /stats and /upload paths, and the published domains and IPs.
  4. Do not rely on domain lists alone. The operator rotates hosts and web properties within days. Re-scan response bodies, certificates, port combinations, and content relationships regularly.
  5. Treat fake-login exposure separately from exploit success. If a user entered Apple, AWS, or other credentials, revoke sessions and tokens, reset credentials, and review account activity even when the mobile device appears unexploited.
  6. Escalate suspected mobile compromise carefully. Preserve device and MDM state, network and DNS logs, browser history, crash and analytics artifacts, identity-provider logs, and exact timestamps before reset. Engage a mobile-forensics specialist for high-risk cases.
  7. Avoid actor attribution from DarkSword alone. Correlate infrastructure, lure language, victimology, panel artifacts, malware configuration, and timing. The public leak means shared exploit code is weak attribution evidence.

Evidence and attribution caveats

Censys describes a Chinese-speaking operator based on panel language, lures, contact material, and infrastructure artifacts. It does not name the actor or establish state sponsorship. The 27-host/180-property snapshot and the separate 100-property file collection measure different populations and dates; they should not be added together.

GTIG has observed DarkSword with multiple clusters and payloads, including GHOSTBLADE, GHOSTKNIFE, and GHOSTSABER. Censys's new infrastructure work specifically tracks a GHOSTBLADE-capable leaked-kit deployment. Shared files and dual Coruna/DarkSword hosting show capability reuse, not a single global operator.

Sources