Proofpoint has disclosed details of a targeted email campaign in which threat actors with ties to Russia are leveraging the recently disclosed DarkSword exploit kit to target iOS devices.
The activity has been attributed with high confidence to the Russian state-sponsored threat group known as TA446, which is also tracked by the broader cybersecurity community under the monikers Callisto, COLDRIVER, and Star Blizzard (formerly SEABORGIUM). It's assessed to be affiliated with Russia's Federal Security Service (FSB).
The hacking group is known for spear-phishing campaigns aimed at harvesting credentials from targets of interest. However, attacks mounted by the threat actor over the past year have targeted victims' WhatsApp accounts, as well as leveraged various custom malware families to steal sensitive data.
The latest activity, highlighted by Proofpoint and Malfors, involves using fake "discussion invitation" emails spoofing the Atlantic Council to facilitate the delivery of GHOSTBLADE, a dataminer malware, via the DarkSword exploit kit. The emails were sent from compromised senders on March 26, 2026. One of the email recipients was Leonid Volkov, a prominent Russian opposition politician and the political director of the Anti-Corruption Foundation.
An automated analysis triggered by Proofpoint's security tools is said to have redirected to a benign decoy PDF document, likely because of server-side filtering put in place to only lead iPhone browsers to the exploit kit.
"We have not previously observed TA446 target users' iCloud accounts or Apple devices, but the adoption of the leaked DarkSword iOS exploit kit has now enabled the actor to target iOS devices," Proofpoint said.
The enterprise security firm also noted that the volume of emails from the threat actor has been "significantly higher" in the last two weeks, adding that these attacks lead to the deployment of a known backdoor referred to as MAYBEROBOT via password-protected ZIP files.
The group's use of DarkSword has also been corroborated by the fact that a DarkSword loader uploaded to VirusTotal has been found to reference "escofiringbijou[.]com," a second-stage domain attributed to the threat actor.
A urlscan[.]io result has revealed that the TA446-controlled domain has served the DarkSword exploit kit, including the initial redirector, exploit loader, remote code execution, and Pointer Authentication Code (PAC) bypass components. However, there is no evidence that sandbox escapes were delivered.
It's suspected that the TA446 is repurposing the DarkSword exploit kit for credential harvesting and intelligence collection, with Proofpoint noting that the targeting observed in the email campaign was "much wider than usual" and that it included government, think tank, higher education, financial, and legal entities.
This, in turn, has raised the possibility that the threat actor is leveraging the new capability afforded by DarkSword as part of an opportunistic campaign against a broader target set.
The development comes as Apple has begun sending Lock Screen notifications to iPhones and iPads running older versions of iOS and iPadOS to alert users of web-based attacks and urging them to install the update to block the threat. The unusual step signals that the company is treating it as a broad enough threat requiring users' immediate attention.
Apple's warning also coincides with the leak of a new version of DarkSword on GitHub, raising concerns that they could democratize access to nation-state exploits, fundamentally shifting the mobile threat landscape.
Justin Albrecht, principal researcher at Lookout, said the leaked, plug-and-play version allows even unskilled threat actors to deploy the advanced iOS espionage kit, turning it into commodity malware.
"DarkSword refutes the common belief that iPhones are immune to cyber threats, and that advanced mobile attacks are only used in targeted efforts against governments and high-ranking officials," Albrecht added.
Facts Only
Proofpoint disclosed a targeted email campaign by Russian-linked threat actors using the DarkSword exploit kit to target iOS devices.
The threat group TA446 (also known as Callisto, COLDRIVER, and Star Blizzard) is assessed with high confidence to be affiliated with Russia's Federal Security Service (FSB).
The campaign involved fake "discussion invitation" emails spoofing the Atlantic Council, sent on March 26, 2026.
The emails delivered GHOSTBLADE malware via the DarkSword exploit kit.
One recipient was Leonid Volkov, a Russian opposition politician and political director of the Anti-Corruption Foundation.
Proofpoint's security tools detected an automated analysis redirecting to a benign decoy PDF, likely due to server-side filtering targeting iPhone browsers.
TA446 has not previously targeted iCloud accounts or Apple devices but has now adopted the DarkSword exploit kit.
The group's email volume has significantly increased in the past two weeks, deploying the MAYBEROBOT backdoor via password-protected ZIP files.
A DarkSword loader uploaded to VirusTotal referenced "escofiringbijou[.]com," a domain linked to TA446.
The TA446-controlled domain served DarkSword components, including exploit loader and remote code execution, but no sandbox escapes were detected.
The campaign targeted government, think tank, higher education, financial, and legal entities.
Apple has issued Lock Screen notifications to iPhones and iPads running older iOS versions, warning of web-based attacks and urging updates.
A new version of DarkSword was leaked on GitHub, raising concerns about broader access to advanced mobile exploits.
Executive Summary
Full Take
The strongest version of this narrative highlights a concerning evolution in state-sponsored cyber threats: a Russian-linked group, TA446, has expanded its arsenal to include the DarkSword exploit kit, enabling attacks on iOS devices—a platform previously considered more secure. The campaign's use of spoofed emails from a reputable think tank (Atlantic Council) and targeting of high-profile individuals like Leonid Volkov underscores the group's strategic focus on intelligence collection. The broader targeting of government, financial, and academic entities suggests a shift from precision strikes to opportunistic mass exploitation, possibly driven by the leak of DarkSword on GitHub. This democratization of advanced exploits could lower the barrier for less skilled actors, amplifying the threat landscape.
Patterns detected: ARC-0024 Ambiguity (the article frames the threat as both targeted and opportunistic without resolving the tension), ARC-0043 Motte-and-Bailey (the narrative oscillates between "nation-state precision" and "broad democratization" without clarifying which is dominant).
Root cause: The paradigm here is the erosion of platform security assumptions. iOS, long marketed as a fortress, is now vulnerable to commoditized exploits, challenging the notion that state-level threats only target high-value individuals. The unstated assumption is that leaks of such tools are inevitable, and the response must shift from prevention to mitigation.
Implications: Human agency is at risk as users face threats beyond their control—even updating devices may not fully protect against zero-day exploits. The beneficiaries are threat actors who gain leverage, while costs are borne by individuals and institutions forced into perpetual defense. Second-order consequences include potential overreach in surveillance justifications and a chilling effect on digital dissent.
Bridge questions: How might the leak of DarkSword reshape the economics of cyber espionage? What countermeasures could Apple implement beyond patching to address systemic vulnerabilities? If TA446's tactics are indeed broadening, what does this reveal about Russia's cyber strategy priorities?
Counterstrike scan: A coordinated influence campaign would amplify fear of iOS vulnerabilities to undermine trust in Apple's ecosystem, possibly to benefit competitors or justify government surveillance expansion. The actual content aligns with this pattern only partially—it reports genuine threats but lacks the hyperbolic framing typical of disinformation. The focus on technical details and attribution to a known actor suggests legitimate reporting rather than manipulation.
Sentinel — Human
The article, while not perfectly human, exhibits signs of being written by a knowledgeable and passionate journalist. The stylometric signals suggest some deviation from AI-generated text, and the presence of specific details and references support a likely human origin.