TA446 Uses DarkSword Exploit Kit to Target iPhone Users

A Russia-linked espionage group TA446 has begun using the leaked DarkSword iOS exploit kit in a spear‑phishing campaign spoofing Atlantic Council event invites to target government, think-tank, higher-education, financial, and legal organizations. Researchers observed TA446-controlled and compromised redirector domains (escofiringbijou.com, motorbeylimited.com, bridetvstreaming.org) serving the DarkSword redirector, loader, RCE, and PAC bypass stages; Apple has pushed updates and defenders are advised to patch devices, block known infrastructure, and monitor for Safari exploit-chain activity.