UNC6748

UNC6748 is a threat cluster associated with targeted exploitation of Apple iOS devices through the DarkSword exploit kit beginning in November 2025. It was the first observed user of DarkSword and conducted attacks against users in Saudi Arabia through a Snapchat-themed impersonation site that triggered exploitation in Safari. Post-compromise activity linked to UNC6748 involved deployment of the GHOSTKNIFE JavaScript backdoor. UNC6748 has been linked to use of a full-chain iOS exploitation capability affecting iOS 18.4 through 18.7 and enabling complete device compromise. The DarkSword chain combined six vulnerabilities to achieve remote code execution, sandbox escape, privilege escalation, and kernel-level access. Malware associated with UNC6748 was capable of exfiltrating signed-in account data, messages, browser data, location history, and microphone recordings. Reporting also notes anti-forensic behavior including deletion of crash logs and short-lived post-exploitation activity designed to reduce forensic visibility. The cluster has been described as a customer of the Turkish commercial surveillance vendor PARS Defense, indicating access to commercial spyware or exploit-as-a-service capabilities rather than an independently attributed nation-state program. High-confidence reporting directly ties UNC6748 to Saudi Arabia-focused mobile surveillance operations and to delivery of GHOSTKNIFE via phishing or impersonation infrastructure. Broader geopolitical attribution beyond that relationship is not currently available.