Actor Profile

An unidentified Chinese-speaking threat actor conducting mobile exploitation campaigns against iOS devices. The actor operates extensive infrastructure spanning over 100 web properties concentrated in Hong Kong with reach into Japan, the United States, and Europe. Attribution is based on Chinese-language interface elements in administration panels and targeting patterns. The actor's motivation appears to be credential theft and data exfiltration, leveraging publicly leaked exploit tooling rather than developing proprietary capabilities. A visible reference to "亚太集团" (Asia-Pacific Group) appears in one control panel, alongside a Telegram contact channel (hxxps://t[.]me/YATA0000), suggesting organized operations with established communication channels.

TTPs (Tactics, Techniques, Procedures)

The actor employs watering hole attacks using fake AWS sign-in pages and Apple ID credential-harvesting decoys to deliver exploitation chains. Initial access leverages the leaked DarkSword exploit kit targeting iOS versions 18.4-18.7 via malicious iframe elements that load JavaScript payloads. The attack chain deploys GHOSTBLADE information-stealing malware with modules for keychain dumping, iCloud credential theft, Wi-Fi credential extraction, and file exfiltration. Data is packaged and transmitted to attacker-controlled endpoints, then retrieved via three distinct administration panels: DarkSword Admin, Decode Dashboard, and C2 Control Panel. Infrastructure evidence shows use of multiple exploit kits including Coruna (targeting iOS 3.0-17.2.1), suggesting toolkit diversification. The operation demonstrates credential access (phishing pages), execution (JavaScript exploitation), collection (credential dumping modules), and exfiltration capabilities across a geographically distributed C2 infrastructure.

Targets & Patterns

The campaign primarily targets technology sector entities and individuals using Apple iOS devices, with specific focus on users who may access AWS services or Apple ID authentication pages. Geographic targeting spans multiple regions including Hong Kong, Japan, the United States, and Europe, suggesting broad opportunistic targeting rather than narrow regional focus. The use of AWS console impersonation indicates targeting of cloud infrastructure users, likely including developers, system administrators, and IT professionals. The watering hole methodology suggests the actor seeks to compromise specific communities or organizations whose members frequent particular websites. Historical DarkSword usage by other actors has targeted Saudi Arabia, Turkey, Malaysia, and Ukraine, though this specific Chinese-speaking actor's victim set remains unclear from available evidence.

Historical Context

DarkSword was originally discovered and documented by Google Threat Intelligence Group (GTIG), iVerify, and Lookout earlier in 2026, with observed use by commercial surveillance vendors and suspected state-sponsored actors in campaigns dating to at least November 2025. Following a public leak of the DarkSword source code, multiple threat actors adopted the toolkit, expanding its use beyond the original operators. This Chinese-speaking actor represents one such secondary adopter, using the leaked kit rather than a reimplementation—evidenced by shared staging-page hashes and Russian-language code comments from the original source. The actor also demonstrates familiarity with Coruna, an older iOS exploit kit predating DarkSword. Censys research suggests potential overlap with UNC6353, a threat actor known to leverage both DarkSword and Coruna in attacks against Ukrainian targets, though direct attribution linkage remains unconfirmed. The discovery of "Thorn C2" references in exposed tooling indicates previously undocumented malware families in the actor's arsenal.

Defensive Recommendations

  • Block network connections to identified C2 infrastructure: 38.181.52[.]95, 103.106.190[.]217, 38.22.89[.]117, 103.97.128[.]67, 162.4.136[.]30, 223.26.63[.]56, 151.243.126[.]191, 107.175.49[.]181, 103.238.129[.]112, 103.226.155[.]200, 103.226.155[.]201, 202.8.120[.]249, and 93.152.221[.]37
  • Ensure all iOS devices are updated beyond version 18.7 to patch DarkSword-exploited vulnerabilities; monitor for devices running iOS 18.4-18.7 and iOS 3.0-17.2.1 (Coruna targets)
  • Implement web filtering and DNS monitoring to detect access to fake AWS console subdomains and Apple ID phishing pages; alert on iframe-based JavaScript loading patterns consistent with watering hole delivery
  • Deploy mobile threat defense (MTD) solutions capable of detecting GHOSTBLADE indicators, including keychain access anomalies, iCloud credential dumping, Wi-Fi configuration exfiltration, and unusual file access patterns
  • Monitor for outbound connections from iOS devices to Hong Kong, Singapore, Japan, US, and European hosting infrastructure on non-standard ports (8888, 3000); investigate any iOS device exhibiting credential-dumping behavior or connections to administration panels with Chinese-language interfaces

---

# Geopolitical Context

Geopolitical Context

The campaign represents a diffusion of commercial surveillance capabilities following the public leak of the DarkSword exploit kit, originally assessed to have been used by commercial vendors and suspected state-sponsored actors. The threat actor operates infrastructure spanning Hong Kong, Singapore, Japan, the United States, and Europe, deploying credential-harvesting decoys (AWS and Apple ID sign-in pages) to facilitate iOS exploitation. DarkSword was previously linked to campaigns targeting Saudi Arabia, Turkey, Malaysia, and Ukraine since November 2025, suggesting prior use in geopolitically motivated operations. The current actor's use of Chinese-language administration panels and self-identification as "Asia-Pacific Group" (亚太集团) indicates regional focus, though attribution to state or non-state actors remains unclear. The leak has democratized access to advanced mobile exploitation tools, lowering barriers for espionage operations.

State Actor Alignment

The campaign is attributed to an unknown Chinese-speaking threat actor. While DarkSword was previously assessed to have been used by suspected state-sponsored actors and commercial surveillance vendors in operations against Saudi Arabia, Turkey, Malaysia, and Ukraine, the current operator's relationship to state interests is undetermined. The actor's infrastructure concentration in Hong Kong and use of Chinese-language tooling is consistent with China-nexus operations, but the reliance on leaked—rather than proprietary—exploit code may suggest non-state or lower-tier actors. Censys notes that threat actor UNC6353 has leveraged both DarkSword and the related Coruna kit in attacks on Ukrainian targets, though direct linkage to the current campaign is not established. No sanctions or formal attribution have been announced.

Business Impacty pro region

The campaign's infrastructure footprint across Hong Kong, Singapore, Japan, the United States, and Europe indicates a broad targeting aperture, though specific victim profiles remain unclear. The use of AWS and Apple ID credential-harvesting pages suggests targeting of technology sector personnel or users with access to cloud infrastructure. Previous DarkSound deployments against Saudi Arabia, Turkey, Malaysia, and Ukraine—and UNC6353's focus on Ukrainian targets—suggest potential interest in geopolitically sensitive regions. For Europe, the presence of Frankfurt-based infrastructure hosting operator tooling raises concerns about targeting of European entities or use of European hosting for operational security. The leak-driven proliferation of iOS exploitation capabilities threatens mobile security across democratic institutions, civil society, and private sector targets globally, particularly where iPhone adoption is high among high-value targets.

Forecast

If the DarkSword source code remains publicly accessible, additional threat actors—including those with limited technical sophistication—are likely to adopt the kit for espionage or criminal operations, expanding the threat surface for iOS users globally. If the current operator maintains infrastructure concentration in Asia-Pacific jurisdictions with permissive hosting environments, disruption efforts may face jurisdictional and legal obstacles. If Apple's patches for iOS 18.4–18.7 vulnerabilities achieve widespread adoption, the kit's effectiveness will diminish, though unpatched devices and zero-day successors may sustain exploitation. If the "Asia-Pacific Group" operator expands credential-harvesting operations beyond AWS and Apple ID decoys, technology sector and cloud service users face elevated risk of account compromise and data exfiltration. If law enforcement or industry partners identify the Telegram contact channel (t[.]me/YATA0000) as actionable intelligence, operational disruption or attribution may advance.