Russian APT Group StarBlitz Uses DarkSword iOS Exploit Kit for Attacks

Cyber Threats Evolving: Star Blizzard Incorporates DarkSword iOS Exploit Kit

The Russian state-sponsored advanced persistent threat (APT) group, Star Blizzard, has recently upgraded its capabilities by incorporating the DarkSword iOS exploit kit into its arsenal. This move marks a significant escalation in the group’s tactics, as it now targets both Windows and Apple devices.

• The primary objective of this operation appears to be credential harvesting and intelligence gathering.
• This campaign utilizes Atlantic Council-themed lures to deliver the GhostBlade malware, indicating a shift from traditional, more targeted attacks.
• The increased volume of malicious emails observed during this period suggests a deliberate effort to expand the scope of their operations.
• Evidence of the DarkSword exploit kit’s usage includes a loader uploaded to VirusTotal that references a secondary domain associated with the hacking group.
• A submission on URLScan shows the successful deployment of the exploit, further confirming the integration of this new capability into the group’s toolkit.

Victims Across Various Sectors

The victims of this campaign include organizations across different sectors:

• Finance
• Government
• Higher education
• Legal entities

Implications and Recommendations

As the threat landscape continues to shift, it is essential for businesses and individuals to stay informed and take proactive measures to protect themselves against emerging threats.

About Author

Anuj

See author's posts