Indicators are what attackers leave behind. Stolen credentials are what they arrive with.
2 IOCs
Chinese-Speaking Operator Runs DarkSword iOS Exploit Kit Across 180 Web Properties
Excerpt
A Chinese-speaking threat operator has deployed the leaked DarkSword iOS exploit kit across at least 180 web properties, according to infrastructure scanning data. The activity involves rotating hosts, fake cloud and Apple ID login pages, and multiple control panels used to manage stolen data. DarkSword is a commercial iOS exploit chain targeting iOS 18.4 through 18.7. The kit reportedly combines six vulnerabilities to bypass security controls, escape the sandbox, and deploy…
Read the original report →Diamond Model
Adversary
Infrastructure(1)
Capability
Victim
Indicators of Compromise
Open the mindmap →2 indicators
| Type | Indicator | Confidence | Score | First Seen |
|---|---|---|---|---|
| IP | 103.106.190.217 | High | Score 61/100 | First seen |
| SHA256 | 46a0bd09f145ab909e5bf45fafe906f452f06971bd227653f0c52af8e22da89e | Medium | Score 53/100 | First seen |
IOC Relationship Graph
Building graph…