Vulnerabilities - CISA Orders Patch for DarkSword Exploits

The Flaw

CISA recently ordered U.S. government agencies to address three critical vulnerabilities in iOS devices that have been exploited in cyberattacks. These vulnerabilities are part of the DarkSword exploit kit, which has been linked to incidents involving cryptocurrency theft and cyberespionage. The flaws, tracked as CVE-2025-31277, CVE-2025-43510, and CVE-2025-43520, allow attackers to escape sandboxes, escalate privileges, and execute remote code on unpatched iPhones. This poses a significant threat to users running iOS versions 18.4 through 18.7.

The vulnerabilities were identified by researchers from the Google Threat Intelligence Group (GTIG) and iVerify. They discovered that the DarkSword exploit kit leverages a chain of six vulnerabilities, making it a powerful tool for malicious actors. The exploitation of these flaws can lead to severe consequences, including unauthorized access to sensitive data and complete control over compromised devices.

What's at Risk

The potential impact of the DarkSword vulnerabilities is considerable. Attackers can deploy various malware families, including the aggressive GhostBlade infostealer and the GhostKnife backdoor, which can exfiltrate vast amounts of data. The GhostSaber JavaScript can also execute code and steal data from infected devices. These malware variants are particularly dangerous as they can operate stealthily, making detection challenging.

Moreover, the vulnerabilities have been exploited in watering-hole attacks targeting iPhone users visiting compromised websites in Ukraine. The connection to multiple threat groups, including a suspected Russian espionage group, highlights the geopolitical implications of these vulnerabilities. The risk extends beyond federal agencies, affecting any organization that utilizes iOS devices susceptible to these exploits.

Patch Status

In response to these threats, CISA has added the three vulnerabilities to its catalog of actively exploited security flaws. Federal Civilian Executive Branch (FCEB) agencies are required to secure their devices by April 3, as mandated by Binding Operational Directive (BOD) 22-01. Apple has already released patches for these vulnerabilities in the latest iOS updates, but devices running older versions remain at risk.

CISA has emphasized the importance of applying mitigations according to vendor instructions. They also warned that such vulnerabilities are frequent attack vectors for malicious cyber actors, posing significant risks to the federal enterprise and beyond. While the directive primarily targets federal agencies, CISA encourages all organizations to prioritize securing their devices against these vulnerabilities.

Immediate Actions

Organizations should take immediate steps to mitigate the risks associated with the DarkSword vulnerabilities. Here’s what you can do:

• Update iOS Devices: Ensure that all iPhones are updated to the latest iOS version to receive the necessary security patches.
• Monitor for Unusual Activity: Keep an eye on devices for any signs of malware or unauthorized access.
• Educate Employees: Conduct training sessions to inform staff about the risks associated with these vulnerabilities and safe browsing practices.
• Implement Security Best Practices: Use security tools and frameworks to enhance the overall security posture of your organization.

By taking these proactive measures, organizations can significantly reduce the risk of falling victim to attacks exploiting the DarkSword vulnerabilities.