UNC6748

UNC6748 is a threat actor tracked by Google Threat Intelligence Group that has been linked to use of the DarkSword iOS exploit kit since at least November 2025. GTIG first observed UNC6748 using DarkSword via a Snapchat-themed decoy/phishing site, including snapshare[.]chat, to target users in Saudi Arabia. The site impersonated Snapchat and used hidden code to automatically launch the exploit. UNC6748 is described in the reporting as a user of DarkSword and as a customer of Turkish commercial surveillance vendor PARS Defense. DarkSword activity associated with UNC6748 targeted iPhones running iOS 18.4 through 18.7. The exploit chain used six vulnerabilities to achieve full device compromise. In UNC6748 intrusions, the post-exploitation payload was GHOSTKNIFE, a JavaScript backdoor. Reported GHOSTKNIFE capabilities include exfiltration of signed-in account data, messages, browser data, location history, and audio recordings from the device microphone. Additional reporting states GHOSTKNIFE communicates with command-and-control using a custom binary protocol encrypted with ECDH and AES and deletes crash logs to hinder forensic detection. Known alias in the provided content: unc6748. The content also distinguishes UNC6748 from PARS Defense and from UNC6353, a suspected Russian espionage group.