DarkSword

DarkSword is a threat actor associated with advanced exploitation of Apple iOS devices through a multi-stage Safari exploit chain. The actor has been observed using JavaScriptCore remote code execution vulnerabilities for initial access, followed by multiple sandbox escapes, a dyld Pointer Authentication Code bypass, and a kernel privilege-escalation stage that provided physical and virtual memory read/write primitives for post-exploitation. Observed tradecraft shows a high degree of exploit-development sophistication, including version-dependent exploit selection, arbitrary read/write primitive construction, process pivots from Safari WebContent into the GPU process and then into mediaplaybackd, and kernel-level post-exploitation capability. DarkSword used different JavaScriptCore vulnerabilities depending on iOS version, then chained them with a dyld vulnerability to bypass user-mode pointer authentication protections. The actor subsequently escaped Safari’s WebContent sandbox via an ANGLE vulnerability to gain code execution in the GPU process, then exploited an XNU flaw to escape again into mediaplaybackd. A final XNU virtual filesystem race condition was used for kernel-level privilege escalation and memory access primitives. This activity indicates strong capabilities in initial access, defense evasion, privilege escalation, and post-exploitation on iOS. DarkSword has also been linked to GHOSTBLADE, which was assessed as likely developed by the actor and contained references to post-exploitation libraries. The available evidence supports characterization of DarkSword as a highly capable exploit operator focused on iOS compromise. Attribution to a specific country, victim geography, industry focus, or dominant strategic motivation is not currently available from the supplied facts.