TA446 Deploys DarkSword iOS Exploit Kit in Targeted Spear-Phishing Campaign

Proofpoint has disclosed a spear-phishing campaign by Russian state-sponsored group TA446 (also known as Callisto, COLDRIVER, Star Blizzard) leveraging the DarkSword iOS exploit kit.

• •Fake "discussion invitation" emails spoofing the Atlantic Council were used to deliver GHOSTBLADE dataminer malware via DarkSword, targeting iOS devices
• •One confirmed target was Leonid Volkov, a Russian opposition politician affiliated with the Anti-Corruption Foundation
• •Server-side filtering in the exploit kit redirects non-iPhone browsers to a benign decoy PDF, evading automated analysis
• •The campaign also deploys a backdoor called MAYBEROBOT via password-protected ZIP files, with email volume significantly higher in the past two weeks
• •A leaked plug-and-play version of DarkSword on GitHub raises concerns about democratizing access to nation-state-level iOS exploits for unskilled threat actors