UNC6353

UNC6353 is a Russia-linked cyberespionage threat cluster tracked by Google Threat Intelligence Group that targets Ukrainian iPhone users through watering-hole attacks. Its operations have used compromised Ukrainian websites belonging to regional news organizations, local courts, industrial-equipment vendors, e-commerce businesses, and local-service providers. The cluster is distinct from TA446, also known as ColdRiver and Star Blizzard; no additional aliases or subgroups are established. UNC6353 has deployed both the Coruna and DarkSword iOS exploit kits, using Coruna before incorporating DarkSword into campaigns observed from late 2025 through March 2026. Coruna supports vulnerable devices running iOS 13.0 through 17.2.1, while DarkSword targets vulnerable versions of iOS 18.4 through 18.7. The actor injects malicious JavaScript into legitimate compromised websites, allowing visits by targeted users to initiate browser exploitation with minimal additional interaction. The exploit chains combine browser compromise, sandbox escape, and kernel privilege escalation to enable access to sensitive device data. Its DarkSword operations support credential theft and collection of messages, contacts, call histories, and other private information. The tooling emphasizes rapid exfiltration and removal of temporary artifacts rather than persistent access, enabling short-duration surveillance while reducing forensic evidence. Although the cluster is associated with Russian espionage activity, a specific sponsoring agency has not been established.