GajShield Threat Advisory — DarkSword / P7 DarkSword and Coruna iOS Exploit Kits: Exploit Delivery, Implant and Infrastructure Coverage

Severity: High | Priority: 1

This GajIPS update adds network-layer detection for DarkSword and Coruna, two iOS exploit kits now widely used by criminal and state-linked groups. DarkSword targets iPhones running iOS 18.4 to 18.7. It chains several iOS vulnerabilities to escape the Safari sandbox, gain kernel-level control and inject its implant into SpringBoard, the process that runs the iPhone home screen. Coruna targets older devices running iOS 13.0 to 17.2.1, and the same operators deploy it alongside DarkSword. Since the kits leaked in late 2025, groups targeting Saudi Arabia, Turkey, Malaysia and Ukraine have used them, as have Chinese-speaking groups focused on cryptocurrency theft.

The new signatures detect:

• DNS lookups and TLS connections from devices in your network to known DarkSword and Coruna exploit-delivery and command-and-control domains;
• connections to the kits' known server IP addresses;
• devices downloading the kits' exploit stages and implant modules;
• the P7 implant checking in with its command server and uploading photos;
• the kits' session cookie;
• TLS certificates issued by the operators' own certificate authority.

If these alerts trigger in your network, find the device behind the source address, usually an iPhone or iPad on corporate or guest Wi-Fi, and its owner.

• Domain, download and exploit-stage alerts mean the device visited an exploit page and may have been compromised.
• Implant check-in, photo upload and certificate alerts mean the implant is very likely running.

For a device that may be compromised:

• Disconnect it from your network.
• Update it to the latest iOS version and restart it. The implant runs in memory and does not survive a reboot, but data already taken is gone.
• From a different, trusted device, change the passwords for the Apple ID and any accounts stored in the iCloud Keychain, and sign out of all other sessions.
• Move any cryptocurrency held in wallet apps on the device to a new wallet created on a clean device, because wallet recovery phrases may have been stolen.