Excerpt
Executive summary
Open directories on five hosts exposed the full DarkSword/Coruna iOS exploit-and-harvest platform, from the C2 delivery server to the per-wallet theft modules. The infrastructure was still in use at triage time. The platform runs a commercial exploitation-as-a-service operation. A copy of the production server recovered 11 victim recovery phrases, 179 device loot directories, and a 75-account control-plane roster.
A separate China-based operator is running the same kit in the wild against its own C2, distinct from every other tracked DarkSword actor.
The operator is developi…
The opening of the report, shown for reference. The full report, with its figures and indicators, is published by Censys on censys.com.
Mentioned in the excerpt
More from Censys1
- AsyncRAT Family Threat OverviewCensys · Published 26 Jun
On the same topics
- Stray Cat, Open Doors: How k0t Wanders Through the Network EdgeGroup-IB · Published 21 Oct
- Resources - SecurityScorecardSecurityScorecard · Added 25 Oct
- ARMORY CASTLE Exploits BeyondTrustMandiant (Google) · Published 15 Oct
- skanthak.homepage.t-online.de/sentinel.htmlskanthak.homepage.t-online.de · Added 18 Oct
