DarkSword

DarkSword is a threat actor observed by GTIG exploiting a multi-stage iOS Safari exploit chain. GTIG observed DarkSword using two JavaScriptCore vulnerabilities for initial remote code execution depending on iOS version: CVE-2025-31277 against iOS versions prior to 18.6 and CVE-2025-43529 against iOS 18.6 through 18.7. Both exploit paths were directly chained with CVE-2026-20700 in dyld to bypass user-mode Pointer Authentication Codes and execute arbitrary code. DarkSword then used two sandbox escapes: CVE-2025-14174 in ANGLE to pivot from Safari’s WebContent sandbox into the GPU process, and CVE-2025-43510 in XNU to pivot from the GPU process into mediaplaybackd. In the final stage, DarkSword used CVE-2025-43520, a kernel race condition in XNU’s virtual filesystem implementation, to obtain physical and virtual memory read/write primitives for post-exploitation. GTIG assessed that a GHOSTBLADE sample was likely developed by DarkSword based on artifacts indicating a post-exploitation library structure. The sample also contained a reference to an unimplemented function named startSandworm(). No additional aliases or sub-groups were provided in the content.