Indicators are what attackers leave behind. Stolen credentials are what they arrive with.
55 IOCs
Threat Intelligence | Analysis of the DarkSword Trojan Backend and iOS Attack Chain
Malware Families
Excerpt
Background On March 18, 2026, Google Threat Intelligence Group published a report titled “The Proliferation of DarkSword: iOS Exploit Chain Adopted by Multiple Threat Actors,” focusing on the spread of the DarkSword exploit chain among multiple threat groups. This chain targets iPhones running iOS 18.4 through 18.6.2. Simply opening a specific page in Safari triggers the exploit, which ultimately steals files, Keychain data, and keyboard input, primarily targeting three…
Read the original report →Diamond Model
Adversary
Infrastructure(6)
Capability(1)
Victim
Indicators of Compromise
Open the mindmap →55 indicators
| Type | Indicator | Confidence | Score | First Seen |
|---|---|---|---|---|
| Domain | vartn8iau6vpk.org | High | Score 58/100 | First seen |
| URL | https://8ll.im/static/sdk.min.js | High | Score 58/100 | First seen |
| URL | https://3kxw2pjsb5hgq24t5qb.cc/darksward/rce_loader.js | High | Score 58/100 | First seen |
| URL | https://3kxw2pjsb5hgq24t5qb.cc/index.html | High | Score 58/100 | First seen |
| SHA256 | 88511bc5b2cf91f0badd10b62fcaea28225eb201cebcb62583b7636a14514305 | Medium | Score 53/100 | First seen |
| SHA256 | 02e3888e5bbf31b78da117b70be28c56777b278d4591b39925c3670cb3a6442b | Medium | Score 53/100 | First seen |
| SHA256 | a1e9fcee41479a73664ec045bb532a392bb35de773ca376109a0e07722a2f051 | Medium | Score 53/100 | First seen |
| SHA256 | a9cd377c5fdb7671fe28e5655059051dee2e609276d19908a2a49475c1009bc4 | Medium | Score 53/100 | First seen |
| MD5 | 06ade268c4bc32e1d933a594e648ac6b | Medium | Score 53/100 | First seen |
| Domain | huncvkov9.icu | High | Score 58/100 | First seen |
| SHA256 | df1349655d7b4a9d5f2d753629a70893862c03aa91bb9d850a79e55b37727bad | Medium | Score 53/100 | First seen |
| URL | https://3kxw2pjsb5hgq24t5qb.cc/sdk/register | High | Score 58/100 | First seen |
| SHA256 | 21fabf605f421e71c28758fdca59b71da740ca5fe40d00e30dec8d32cb499e4a | Medium | Score 53/100 | First seen |
| SHA256 | fdf227df835cc7e90a483e7c82353b6d253c8aca0478c2e630d8aa2c340f6c5f | Medium | Score 53/100 | First seen |
| SHA256 | eb66bc5b0c5e57d0a4272a004250ee3ddbd755e3464a554a9fb31ff494c8d18f | Medium | Score 53/100 | First seen |
| Domain | d.guonal.fit | High | Score 58/100 | First seen |
| IP | 160.20.58.27 | High | Score 58/100 | First seen |
| URL | https://3kxw2pjsb5hgq24t5qb.cc/static/v2_18/ | High | Score 58/100 | First seen |
| SHA256 | 49a279c21493e24fcd5c6ce6d898e194a7252da5851e8ff7b7715b97137861fe | Medium | Score 53/100 | First seen |
| SHA256 | e35878dd45b9762b42a35a5a311eb16054056e3dc295d8705f5466b715d92925 | Medium | Score 53/100 | First seen |
| SHA256 | 37efaa4237a28a4be411d40de80b2935be5b8c4e6731ee1f858c609142a87445 | High | Score 84/100 | First seen |
| URL | https://ad.playios.net/api/sdk-deploy.zip | High | Score 58/100 | First seen |
| URL | https://ios-app.addlabelorg.com/console/ | High | Score 58/100 | First seen |
| URL | https://3kxw2pjsb5hgq24t5qb.cc/29df87ca7af308ebea209f30890d373f5f7f2f93.html | High | Score 58/100 | First seen |
| Domain | z.1688ac.cc | High | Score 58/100 | First seen |
| URL | https://3kxw2pjsb5hgq24t5qb.cc/sdk.min.js | High | Score 58/100 | First seen |
| IP | 192.252.179.227 | High | Score 58/100 | First seen |
| URL | https://310ijpo06dd-ijsxcfu.org/beacon | High | Score 58/100 | First seen |
| Domain | 8jh2oinahnr4rntb4vj80ayy.app | High | Score 58/100 | First seen |
| Domain | playios.net | High | Score 58/100 | First seen |
| Domain | met2ndsiu8k.icu | High | Score 58/100 | First seen |
| IP | 103.230.240.71 | High | Score 58/100 | First seen |
| URL | https://3ll.im/ | High | Score 58/100 | First seen |
| SHA256 | 28dc591c6b5ba43d1c02dca653e6f9f65e8e085be73b72605f0b5e718abda2cf | Medium | Score 53/100 | First seen |
| URL | http://103.230.240.71:7001/login | High | Score 58/100 | First seen |
| URL | https://310ijpo06dd-ijsxcfu.org/api/ds/log | High | Score 58/100 | First seen |
| URL | https://8ll.im/ | High | Score 58/100 | First seen |
| URL | https://ad.playios.net/ | High | Score 58/100 | First seen |
| Domain | fudervzvb.com | High | Score 58/100 | First seen |
| URL | http://160.20.58.27:7001/login | High | Score 58/100 | First seen |
| SHA256 | 4ed41f8b5bad6473bc1b7d955d120e57375f1d29b8755947fc0f6e4af96e78e1 | Medium | Score 53/100 | First seen |
| MD5 | 35f84f903156092fae6f232cc79fc288 | Medium | Score 53/100 | First seen |
| Domain | tpkcosbs.info | High | Score 58/100 | First seen |
| SHA256 | 467cd2dd8e2242ea09e4ce50afc14bd8ae6eeeff642859038faf47f7ccf81316 | Medium | Score 53/100 | First seen |
| SHA1 | 29df87ca7af308ebea209f30890d373f5f7f2f93 | Medium | Score 53/100 | First seen |
| URL | https://877k.org/ | High | Score 58/100 | First seen |
| Domain | addlabelorg.com | High | Score 58/100 | First seen |
| IP | 107.149.129.157 | High | Score 58/100 | First seen |
| MD5 | 69dd25b2ca8b5682ba2470d77124e2fc | Medium | Score 53/100 | First seen |
| SHA256 | ed87a3741feac29f63eba654c45cfed16f8c9542e21a105d7c9ad5304e91eba4 | Medium | Score 53/100 | First seen |
| Domain | com.sixdays.trust | High | Score 58/100 | First seen |
| URL | http://3kxw2pjsb5hgq24t5qb.cc:80/wallet_grab | High | Score 58/100 | First seen |
| Domain | ikspanceem.xyz | High | Score 58/100 | First seen |
| Domain | w83lfokwwmqoyo0r.info | High | Score 58/100 | First seen |
| SHA256 | df687a655411437eb44d67e54a9af9284b8dd489c0873e0605f0e47f96016b5e | Medium | Score 53/100 | First seen |
IOC Relationship Graph
Building graph…