UNC6353

UNC6353 is a suspected Russian espionage threat actor associated with watering-hole operations targeting Ukrainian users, particularly through compromised Ukrainian websites. The group has been linked to use of the Coruna iOS exploit kit and later adoption of the DarkSword full-chain iOS exploit framework beginning in late 2025, with activity continuing into 2026. Reporting consistently characterizes the actor as Russian-linked and aligned with espionage objectives, with some assessments noting overlap between intelligence collection and financially oriented theft. UNC6353 has targeted Ukrainian organizations and users across commercial and local-service contexts, including industrial vendors, retail or e-commerce entities, local services, court-related sites, and regional news outlets in the Donbas area. Its operations have relied heavily on watering-hole delivery, including compromise of legitimate websites and injection of malicious script tags or hidden iframes to selectively exploit visiting iPhone users. In DarkSword operations, UNC6353 used a browser-based exploit chain against vulnerable iOS versions to achieve full device compromise and deploy post-exploitation malware such as GHOSTBLADE. The malware and associated modules have been described as capable of stealing communications data, browser artifacts, credentials, keychain material, Wi-Fi data, location history, photos, health data, iCloud-related data, and cryptocurrency wallet information, followed by rapid exfiltration and cleanup to reduce forensic visibility. The actor has therefore demonstrated capabilities spanning initial access, credential and data theft, post-exploitation collection, exfiltration, and defense evasion. UNC6353 is distinct from TA446/SEABORGIUM and has separately been identified by multiple researchers as one of several actors using proliferated commercial or leaked iOS exploit tooling. The group is notable for combining high-end mobile exploitation with opportunistic website compromise in support of targeted collection against Ukraine.