PARS Defense

PARS Defense is a Turkish commercial surveillance vendor associated with targeted iOS intrusion activity using the DarkSword exploit chain and the GHOSTSABER post-exploitation malware family. Activity linked to PARS Defense was observed from late 2025 against users in Turkey, and later in Malaysia through another PARS Defense customer. The actor has been tied to exploitation of iPhones running affected iOS 18.4 through 18.7 versions, using a sophisticated full-chain compromise that achieved remote code execution, sandbox escape, privilege escalation, and kernel-level access. Operations associated with PARS Defense deployed GHOSTSABER, a JavaScript backdoor supporting more than 15 command-and-control functions. Reported capabilities include device and account enumeration, file listing, file exfiltration, arbitrary JavaScript execution, arbitrary SQLite query execution, and photo thumbnail collection, with some functions such as audio recording and real-time geolocation apparently enabled through additional runtime-downloaded modules. The associated campaigns demonstrated comparatively strong operational security, including obfuscation of exploit stages and encrypted delivery of exploit components. PARS Defense fits the profile of a commercial spyware or lawful-intercept vendor rather than a conventional state intelligence unit, but its tooling and operations are consistent with high-end surveillance activity directed at selected mobile users. Known associated tooling includes DarkSword and GHOSTSABER.