Chinese Threat Actor Uses Leaked DarkSword Kit to Deploy GHOSTBLADE on iOS

Summary

A Chinese threat actor is using the leaked DarkSword exploit kit to deploy GHOSTBLADE malware on iOS devices. The actor operates numerous fake AWS sign-in pages and has been observed targeting iOS versions 18.4 through 18.7.

Key Takeaways

1. An unknown Chinese-threat actor has been observed running a campaign targeting Apple iOS devices by leveraging a publicly leaked version of the DarkSword exploit kit.
2. Attack surface management platform Censys said it identified the threat actor running more than 100 web properties, most of which are fake Amazon Web Services (AWS) sign-in pages on a domain that also hosts the exploit toolkit.
3. The kit, which specifically targets iOS versions 18.4 through 18.7, has been observed to employ watering holes as a starting point to trigger now-patched vulnerabilities in Apple's mobile operating system to execute JavaScript that ultimately facilitates the deployment of GHOSTBLADE, an information-stealing malware.

Statement Breakdown

• Claimed Facts: 70% of statements the article presents as facts
• Opinions: 20% of statements classified as editorial or subjective
• Claims: 10% of statements surfaced for additional reader evaluation

Credibility & Bias Reasoning

Credibility assessment: The article relies on analysis from a reputable cybersecurity firm, Censys, and references previous research from established entities like Google Threat Intelligence Group. It provides specific technical details and IP addresses, lending it a high degree of credibility.

Bias assessment: Technical Reporting. The article focuses on technical details of a cyber threat, presenting factual information about the exploit kit, malware, and attack vectors. The language is objective and informative, aiming to educate the reader about a security incident.

Note: This article provides a technical analysis of a cyber threat. While based on expert findings, readers should cross-reference with official security advisories for comprehensive understanding.

Credibility flag: Technical Analysis

Claimed Facts (7)

• This is a direct statement of an observed activity attributed to a specific actor and tool.
• This presents a factual observation made by a named cybersecurity firm.
• This is a direct quote from a named researcher detailing the geographical distribution of the threat.
• This statement provides background information on the DarkSword exploit kit, citing its discovery and previous usage.
• This details the technical specifics of the exploit kit's operation and its payload.
• This provides specific, verifiable data points about the infrastructure used by the threat actor.
• This describes the functional outcome of a successful exploit.

Opinions (5)

• The phrase 'prompting other threat actors to join the exploitation bandwagon' suggests an interpretation of the situation rather than a directly observed fact.
• The phrase 'some evidence to suggest' indicates a level of inference and interpretation rather than a definitive statement of fact.
• While based on evidence, the interpretation of this evidence as a definitive conclusion about the 'cluster' running the leaked kit is an analytical opinion.
• Describing the panel as 'visually distinct' is a subjective observation.
• The statement 'That's the first direct contact channel we've recovered' is an interpretation of the findings and the significance of the discovery.

Claims (5)

• While presented as a fact, the attribution to an 'unknown Chinese-threat actor' is a strong claim that, while plausible in cybersecurity, relies on inference and may not be definitively proven without further evidence.
• The phrase 'believed to have been used' and 'suspected state-sponsored actors' introduces an element of speculation and unconfirmed attribution.
• While likely based on IP data, the definitive statement of 'concentration' and 'reaching into' these regions without specific data points for each can be an oversimplification or generalization.
• The term 'fairly consistent' implies a degree of generalization. While the described flow is likely typical, stating it as 'fairly consistent' without quantifying the variations or exceptions can be a mild overstatement.
• While IP addresses are factual, the direct association of these IPs with specific panels and their functions, especially without explicit confirmation from the threat actor, relies on the analysis of the researchers and could be subject to misinterpretation or incomplete data.

Key Sources

• Aidan Holland — Researcher, Censys
• Censys — Attack Surface Management Platform
• Google Threat Intelligence Group — Cybersecurity Research Group
• iVerify — Cybersecurity Firm
• Lookout — Cybersecurity Company