Russia-Linked TA446 Targets iPhones With DarkSword

Russia-linked TA446, notorious for its persistent targeting strategies, has turned its focus to iPhones by utilizing the DarkSword iOS exploit kit. This advanced threat group, also known as SEABORGIUM and ColdRiver, is conducting spear-phishing campaigns aimed at compromising iOS devices through malevolent emails. TA446 has been a thorn in the side of NATO countries since at least 2017, extending its reach to the Baltics, Nordics, and Eastern Europe, including Ukraine.

These campaigns are notably resonant, affecting defense, intelligence, think tanks, and educational entities, with a recent spike seen in emails mimicking the Atlantic Council. Proofpoint researchers highlight the strategic pivot of TA446 to iOS exploits, marking a significant evolution in their tactics.

In a rapidly shifting threat landscape, the group’s use of the DarkSword kit underscores the growing risk from state-sponsored cyber threats. For further details, please read the full article here:

Russia-linked APT TA446 uses DarkSword exploit to target iPhone users in phishing wave