A group identified as UNC6353, suspected of having ties to the Russian government, targeted iPhone users in Ukraine with advanced hacking tools, cybersecurity researchers from Google, iVerify, and Lookout revealed. This campaign, related to previous attacks, employs a toolkit named Darksword to access personal data such as passwords, photos, and messages, but avoids persistent surveillance.
Darksword’s brief presence on devices indicates a quick operation, likely aimed at understanding the victims’ activities. The toolkit also has features to target cryptocurrency storages, a rarity for government-tied hackers. This suggests potential financial motivations but lacks concrete evidence of interest from the hackers.
Darksword was professionally developed, allowing modular applications, making it adaptable for additional functions. Researchers see a possible connection to the Coruna toolkit, initially developed by U.S. defense contractor L3Harris. This toolkit was used by various state actors, including Russian spies, against Ukrainians.
Experts believe Darksword’s creation might involve similar parties as Coruna. Justin Albrecht of Lookout suggested UNC6353 operates with significant resources, possibly acting as a Russian criminal proxy, focusing on financial and intelligence objectives.
Rocky Cole from iVerify noted the campaign targeted any visitors to specific Ukrainian websites, implicating a strategy less about specific individuals and more about widespread data collection opportunities within Ukraine.
