Ukrainian report details Russian mobile attacks, including iPhone exploit kit DarkSword

Increased Mobile Targeting in Ukraine

A Ukrainian government report indicates a rise in Russian hacker activity targeting the smartphones of Ukrainian military personnel and government officials. These attacks aim for espionage and financial gain, affecting both Android and iOS devices through malicious applications and advanced exploits.

DarkSword iPhone Exploit Kit

One of the tools identified in these attacks is DarkSword, an exploit kit designed to compromise iPhones. This kit is deployed in watering-hole attacks, where hackers compromise legitimate websites frequented by their targets. In Ukraine, news and government websites have been compromised to exploit vulnerabilities in Apple's Safari browser and iOS.

DarkSword can infect an iPhone with minimal user interaction, allowing hackers to steal sensitive data such as login credentials, messages, contacts, and call histories. Unlike persistent spyware, DarkSword operates as a "hit-and-run" tool, extracting information quickly and then removing its traces from the device.

Android Malware Distribution

Ukrainian authorities also tracked two new hacking groups, UAC-0244 and UAC-0263, which distribute malicious Android apps. These groups use websites impersonating official Ukrainian entities, such as the 3rd Army Corps, or creating deceptive sites like a "men's club" to lure users into downloading the apps.

Broader Impact

The growing reliance on smartphones for communication among military personnel, government employees, and civilians makes these devices attractive targets for intelligence gathering and further compromise. Cybersecurity firm Lookout previously linked DarkSword activity to a suspected Russia-aligned hacking operation, noting its use against Ukrainian users since at least late 2025, including compromising a regional news outlet and a local court website.