Indicators are what attackers leave behind. Stolen credentials are what they arrive with.
3 IOCs
DarkSword Coruna iOS Exploit Kit Targets Crypto Wallets With Live C2 Infrastructure
Malware Families
Excerpt
Researchers have uncovered live DarkSword/Coruna infrastructure exposing a commercial iOS exploit-and-harvest platform built to steal cryptocurrency wallet data. Five open directories revealed malware delivery servers, victim telemetry, exploit-development files, wallet-stealing modules, and an active command-and-control (C2) platform. The infrastructure was still operating when researchers examined it. The exposed operation appears to function as exploitation-as-a-service,…
Read the original report →Diamond Model
Adversary
Infrastructure(2)
Capability(1)
Victim
Indicators of Compromise
Open the mindmap →3 indicators
| Type | Indicator | Confidence | Score | First Seen |
|---|---|---|---|---|
| Domain | 66ds.lol | High | Score 87/100 | First seen |
| IP | 156.239.230.120 | Medium | Score 63/100 | First seen |
| CVE | CVE-2026-31001 | High | Score 63/100 | First seen |
IOC Relationship Graph
Building graph…