CISA ordered U.S. government agencies to patch three iOS vulnerabilities targeted in cryptocurrency theft and cyberespionage attacks using the DarkSword exploit kit.

As Google Threat Intelligence Group (GTIG) and iVerify researchers revealed last week, the DarkSword delivery framework abuses a chain of six vulnerabilities tracked as CVE-2025-31277, CVE-2025-43529, CVE-2026-20700, CVE-2025-14174, CVE-2025-43510, and CVE-2025-43520.

These flaws enable attackers to escape sandboxes, escalate privileges, and gain remote code execution on unpatched iPhones, but have all been patched by Apple in the latest iOS releases and now only affect iPhones running iOS 18.4 through 18.7.

DarkSword was also linked by security researchers to multiple threat groups, including UNC6748, a customer of Turkish commercial surveillance vendor PARS Defense, and a suspected Russian espionage group tracked as UNC6353.

In these attacks, GTIG observed three separate information-theft malware families dropped on victims’ devices: a very aggressive JavaScript infostealer named GhostBlade, the GhostKnife backdoor that can exfiltrate large swaths of data, and the GhostSaber JavaScript that executes code and also steals victims’ data.

Of the three, UNC6353 deployed both the DarkSword and Coruna iOS exploit kits in watering-hole attacks targeting iPhone users visiting compromised Ukrainian websites of e-commerce, industrial equipment, and local services organizations.

​Notably, DarkSword wipes temporary files and exits after stealing data from infected devices, indicating that it was designed for short-term surveillance operations designed to evade detection.

Mobile security company Lookout, which discovered DarkSword while investigating infrastructure used in the Coruna attacks, believes that DarkSword is used in cyber-espionage campaigns aligned with Russian intelligence requirements and by a Russian threat actor with financial objectives.

On Friday, CISA added three of the 6 DarkSword vulnerabilities (CVE-2025-31277, CVE-2025-43510, and CVE-2025-43520) to its catalog of actively exploited security flaws, ordering Federal Civilian Executive Branch (FCEB) agencies to secure their devices within two weeks by April 3, as mandated by Binding Operational Directive (BOD) 22-01.

“Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable,” CISA warned.

“These types of vulnerabilities are frequent attack vectors for malicious cyber actors and pose significant risks to the federal enterprise.”

Although BOD 22-01 applies only to federal agencies, CISA urged all defenders, including those working for private sector companies, to prioritize securing their organizations’ devices against these flaws as soon as possible.

Malware is getting smarter. The Red Report 2026 reveals how new threats use math to detect sandboxes and hide in plain sight.

Download our analysis of 1.1 million malicious samples to uncover the top 10 techniques and see if your security stack is blinded.

Download The Report

The UK’s National Audit Office (NAO) has warned the country is underprepared for a severe space weather event.

While the report commends the UK’s forecasting abilities, even if overall resilience lags, it also highlights more that needs to be done in both areas to handle a severe space weather event.

Recent solar storms have posed a headache for spacecraft and satellite operators. While the impact of the storm in May 2024 was minor, “it moved thousands of satellites from their orbits,” the NAO stated.

A solar flare on September 1, 1859, triggered a magnetic storm known as “the Carrington Event,” one of the largest on record. Telegraph machines reportedly shocked operators and caused small fires. The impact on modern electronics would be severe – communications could be disrupted, there might be localized power outages, satellite navigation might fail, and so on.

In 2025, the government estimated a 5-25 percent chance of a severe space weather event by 2030. However, according to the NAO, the UK is not well prepared. Despite severe space weather being added to the UK’s National Risk Register in 2011, and some investment in developing the country’s forecasting capabilities, the NAO warned that the government “does not yet understand the full range of possible impacts and cascading effects well.”

It has also not “yet set out how resilient it would like the UK to be to severe space weather, nor what level of resilience its spending will provide.”

Forecasting is better, with the UK’s Met Office, which opened a space weather monitoring center in 2014, receiving praise despite limited resources. Up to 96 hours’ warning of a space weather event (depending on its type) is possible, providing a window for operators to take preventive action (for example, shutting down power transformers) to prevent damage.

However, there is only so much that can be done with the current resources. The UK does not have any of its own space weather satellites and must make do with data from partners such as the United States Space Weather Prediction Center. There are spacecraft providing data like the venerable SOHO, launched in the last century and long past the end of its primary mission.

The government is investing millions of pounds in the European Space Agency’s Vigil space weather mission, with a total spend to date of £300 million, but this is not expected to launch before 2031. While the Met Office has begun to think about what might come after that mission, there has been no formal planning.

All of which suggests the UK’s long-term forecasting capability is far from secure. However, the Met Office was taking steps to improve the situation and “is well respected internationally,” the report noted.

What to do when a forecast of severe space weather comes is what concerns the NAO. The report states: “The centre of government has an incomplete understanding of how sectors plan to respond to a severe space weather emergency.”

In blunter terms, the government is not prepared, and hasn’t completely thought through who will do what if the worst happens. Furthermore, “the government has yet to set out what outcome it is looking to achieve and the level of residual impacts it is willing to accept (risk appetite).”

The recommendations are to plug the gaps and have the Department of Science, Innovation and Technology (DSIT) develop a plan to test scenarios by September 2026 and add details for a whole-of-society approach by March 2027.

A government spokesperson told The Register: “While extreme space weather events are rare, the UK is better prepared than ever before – backed by world-class monitoring from the Met Office Space Weather Operations Centre, one of only a handful of 24/7 centres of its kind globally. The government has also invested more than £300 million in Vigil, an ESA satellite mission that will deliver faster and more accurate space weather warnings.

“We recognise there is more to do, so we welcome the NAO’s findings and will consider the recommendations. We will act on these through a new Severe Space Weather Preparedness Strategy, expected to be published later this year, strengthening our resilience even further.” ®