PARS Defense

PARS Defense is identified in the provided content as a Turkish commercial surveillance vendor. Google Threat Intelligence Group linked PARS Defense to DarkSword exploitation activity in Turkey in late November 2025, and later observed DarkSword used in Malaysia by another PARS Defense customer. In these campaigns, PARS Defense deployed the GHOSTSABER backdoor. The content states that GHOSTSABER supports more than 15 command-and-control commands, including device enumeration, file exfiltration, arbitrary SQLite query execution, and photo thumbnail uploads; some capabilities such as audio recording and real-time geolocation appear to rely on follow-on binary modules downloaded at runtime. The Turkey campaign was described as having stronger operational security than UNC6748 activity, including obfuscation of the exploit loader and stages and use of ECDH and AES to encrypt exploits between the server and victim. The activity targeted devices running iOS 18.4 through 18.7 via the DarkSword exploit chain. No additional aliases or sub-groups beyond "pars_defense" / "PARS Defense" are directly provided in the content.