Russians caught stealing personal data from Ukrainians with new advanced iPhone hacking tools

A recent analysis by cybersecurity experts has revealed that a group of hackers, believed to be linked to the Russian government, has launched a series of cyberattacks aimed at iPhone users in Ukraine. The hackers utilized an advanced set of tools engineered to extract personal data and potentially steal cryptocurrency. Researchers from Google, along with security firms iVerify and Lookout, examined these attacks and traced them back to a group identified as UNC6353. Their findings suggest that this campaign is connected to earlier hacking attempts reported this month. The newly discovered hacking toolkit, dubbed Darksword, raises concerns about the increasing sophistication of spyware designed for iPhones. Notably, Darksword is specifically targeting users in Ukraine, indicating a level of restraint that could have otherwise led to a more extensive global hacking operation. Earlier in March, Google had uncovered another sophisticated iPhone hacking toolkit known as Coruna, which initially served a government client before falling into the hands of Russian spies and later, Chinese cybercriminals. The origins of Coruna trace back to the U.S. defense contractor L3Harris, particularly its hacking and surveillance technology division. It was originally intended for Western governments, especially those in the Five Eyes intelligence alliance, which includes Australia, Canada, New Zealand, the United Kingdom, and the United States. The discovery of Darksword, however, reveals a new wave of hacking tools exploiting different vulnerabilities. According to researchers, the Darksword toolkit is engineered to steal sensitive data such as passwords, photos, and messages from WhatsApp, Telegram, as well as browser history. Its design appears to focus on quick data theft rather than ongoing surveillance, allowing it to infect devices, gather information, and then vanish without a trace. Experts from Lookout indicated that Darksword's operational timeframe on a device is brief, often lasting only minutes, depending on the volume of data it manages to extract. Rocky Cole, co-founder of iVerify, suggested that the hackers may have been interested in understanding their victims' lifestyles, which did not necessitate continuous monitoring but rather swift, targeted operations. Interestingly, Darksword also possesses the capability to steal cryptocurrency from popular wallet applications, a move that is unusual for a group reportedly affiliated with a state. Lookout's report raises the possibility that the hackers might have dual motives: financial gain alongside traditional espionage. Cole emphasized, however, that although the malware could be used for cryptocurrency theft, there is no definitive evidence that the hackers had a specific interest in that aspect. The malware's modular design suggests a high level of professionalism in its development, possibly indicating a link between the creators of Darksword and those behind Coruna. As for the group’s identity, Cole pointed towards the Russian government, while Lookout corroborated that the same faction responsible for using Coruna against Ukrainians seems to be behind Darksword. Justin Albrecht from Lookout described UNC6353 as a well-funded entity engaged in operations for both financial gain and espionage, aligning closely with Russian intelligence objectives. He noted the possibility of UNC6353 acting as a proxy for Russian criminal activities, given their dual focus on financial theft and intelligence gathering. Victims of this malware could be anyone visiting specific Ukrainian websites, as the attacks are designed to target users accessing these sites from within Ukraine, indicating a broader reach rather than a strictly targeted campaign.