UNC6748

UNC6748 is a threat cluster associated with targeted iOS compromise using the DarkSword exploit kit. Its activity was first observed in early November 2025, targeting users in Saudi Arabia through a Snapchat-themed phishing website. Visiting the malicious site triggered browser exploitation automatically. UNC6748 has also been identified as a customer of Turkish commercial surveillance vendor PARS Defense; its country of origin and state sponsorship have not been established. UNC6748 used DarkSword to deploy GHOSTKNIFE, a JavaScript backdoor capable of exfiltrating signed-in account data, messages, browser data, location history, and microphone recordings. DarkSword chains browser exploitation, sandbox escapes, and privilege escalation to compromise vulnerable devices running iOS 18.4 through 18.7 and execute payloads with kernel-level privileges. Its post-exploitation framework injects JavaScript execution components into privileged iOS services. GHOSTKNIFE communicates with command-and-control infrastructure using a custom binary protocol encrypted with ECDH and AES, and deletes device crash logs to hinder forensic detection. UNC6748 is distinct from UNC6353, the suspected Russian espionage actor that separately deployed DarkSword against Ukrainian users.