Loading threat actor…
UNC6748 is a threat activity cluster observed targeting iPhone users in Saudi Arabia with the DarkSword iOS exploit kit in November 2025. Its delivery infrastructure impersonated Snapchat, enticing users to visit a malicious website that automatically initiated exploitation. UNC6748 is distinct from other documented DarkSword operators, including Turkish commercial surveillance vendor PARS Defense and suspected Russian espionage actor UNC6353. Its country of origin and state affiliation have not been established. UNC6748 used DarkSword against devices running iOS 18.4 through 18.7. The JavaScript-based exploit chain combines browser exploitation, sandbox escapes, and kernel privilege escalation to compromise devices through Safari. It invokes existing native functions rather than relying on newly introduced native shellcode, helping circumvent platform security mitigations. Following exploitation, UNC6748 deployed GHOSTKNIFE, a JavaScript backdoor capable of exfiltrating signed-in account information, messages, browser data, location history, and microphone recordings. GHOSTKNIFE uses a custom binary command-and-control protocol protected with ECDH and AES encryption and deletes device crash logs to impede forensic investigation.
Who, where, and from where this actor operates. Pulled from open-source reporting and Mallory's analyst review.
Geographies tied to known operations.
20 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt.
4 malware families attributed to this actor across reporting.
6 CVEs this actor has used in observed campaigns. 6 of them exploited in the wild.
1 indicator attributed to this actor. Values are masked here and available in full in Mallory.
10 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.