THE DAILY EDITION · 5 NOVEMBER 2026
Google says suspected Russian group used DarkSword in iPhone attacks on Ukrainian users
Why this story?
Google tied a suspected Russian espionage cluster to a new exploit chain that had been active through March 2026 and affected targets in multiple countries.
Google Threat Intelligence Group said it had seen the suspected Russian espionage actor UNC6353 use the DarkSword exploit chain in a new watering hole campaign aimed at Ukrainian users. The company said the activity was active through March 2026 and dated back to at least December 2025, and that it worked with CERT-UA to mitigate it.
Google said DarkSword is a new iOS full-chain exploit that uses multiple zero-day vulnerabilities to fully compromise devices. It said it had seen several commercial surveillance vendors and suspected state-sponsored actors use the exploit since at least November 2025 against targets in Saudi Arabia, Turkey, Malaysia and Ukraine.
The company said compromised Ukrainian websites were updated with a malicious script that fetched the first stage from an UNC6353 server and then loaded an index page from the same server. Google said the observed UNC6353 use of DarkSword supported iOS 18.4 through 18.6, and that the loader matched the running iOS version.