DarkSword
338 hosts convicted as DarkSword command-and-control servers: 338 still listed, 0 archived. First seen 2026-08-31.
About
A full-chain iOS exploit kit — six vulnerabilities spanning iOS 18.4 to 18.7 — that Google's Threat Intelligence Group documented in March 2026 in use by commercial surveillance vendors and suspected state-sponsored actors. The chain was posted to GitHub later that month, operator consoles built around it have since been published openly, and Censys has counted the kit in the hands of at least seven unrelated operators. What is listed here is operator infrastructure: the console of a server built to receive and review what the kit takes from compromised iPhones, and in some builds to send those phones commands. Never an infected phone, and nothing on this page identifies a victim.
Ports
The 8 ports with the most hosts, of 12.
Observed changes
New networks for this family in this archive, last 7 days: AS218877 on 2026-10-27 (1 host); AS43641 on 2026-10-26 (4 hosts); AS979 on 2026-10-26 (1 host); AS138415 on 2026-10-26 (1 host); AS154376 on 2026-10-26 (1 host); AS400619 on 2026-10-26 (2 hosts). Showing the 6 newest of at least 12.
Estimated moves of this family toward AS7488 on 2026-10-18 (10–99 hosts). These are the scanner’s estimates from passive search data, shown only where this archive also holds a host of this family.
Detection packs
Rules for this hub's 338 still-listed hosts, across all 4 pages of the list, updated with the archive. Withdrawn hosts can stay in these files for up to five minutes. Each listener gets one Suricata rule on its address and port, with the same rule ID in every file: load one set, or let suricata-update merge them. A newer file replaces an older one. YARA rules match file hashes only.
Hosts · page 3 of 4
Newest first by first seen, so later pages shift as hosts are added. Archived hosts are included and marked.
Listed in error?
These pages are generated by automated scanning. If a listing is wrong, email support@publicmosaic.com or see abuse & takedown. To exclude a network range from scanning, see opt-out.