The IT Nerd

Researchers have uncovered a new iOS devices exploit kit dubbed “DarkSword” used to steal data from potentially millions of iPhones running iOS 18.4 through 18.6.2. The attack is linked to the Russian hacking group UNC6353 which recently used the Coruna exploit chain reported by Google and iVerify. 

Brian Bell, CEO of customer identity and access management platform FusionAuth, provided the following comments:

“When a device can be silently compromised when visiting a website, perimeter-based and device-based security collapse. That’s not a future risk, it’s the current reality for anyone with a mobile user base.

The right response isn’t to wait for your users to patch. It’s to build authentication that assumes the device is already compromised. Short-lived tokens, step-up authentication before sensitive actions, forced re-authentication when signals change. Design for the breach, not against it.

And here’s the piece that most teams miss: most authentication platforms are SaaS; your token policies, session controls, and audit logs live in someone else’s cloud, under someone else’s access controls. But when authentication runs inside your own infrastructure, isolated from external dependencies, a compromised device doesn’t cascade into a compromised system. Identity is your last defense, so make sure you own it.”

If you are worried about this new exploit, the fix is simple. Which is to update to iOS 26 as that apparently is not affected. The most recent version of iOS 18 which at the time of this article is 18.7.3 is also not affected. But I would just go straight to iOS 26 as it is likely to protect you from more than this single exploit.

Cybersecurity researchers at Akamai are reporting a sharp rise in malicious online activity following the outbreak of conflict involving Iran, with cybercrime increasing by 245% since late February. The surge includes widespread activity such as credential harvesting attempts, automated reconnaissance, and probing of enterprise infrastructure as attackers capitalize on geopolitical instability.

The financial sector has been the most heavily impacted, accounting for approximately 40% of observed malicious traffic, followed by e-commerce, gaming, and technology companies.

Researchers also observed significant increases in:

• Automated reconnaissance traffic – Up 65%
• Credential harvesting attempts – Up 45%
• Infrastructure scanning for exposed services Up 52%
• Botnet-driven discovery traffic – Up 70%
• DDoS reconnaissance – Up 38%

Analysts warn that the volume and sophistication of activity are likely to persist as cyber operations continue to accompany broader geopolitical tensions.

Sunil Gottumukkala, CEO, Averlon provided this comment:

   “The surge in activity following geopolitical tensions is consistent with what we typically see in these environments. Early-stage signals like reconnaissance, credential harvesting, and infrastructure probing tend to increase significantly as attackers look for initial access opportunities.

   “Enterprises should assume this activity will persist and focus on preparedness. That means staying on top of attack surface and exposure management to reduce exploitable vulnerabilities and ensure known weaknesses cannot be used to gain initial access. It also means strengthening identity security and monitoring for credential misuse, since many of these campaigns rely on stolen credentials.

   “The organizations that fare best are the ones that treat this activity as a precursor to more targeted attacks and invest in visibility into their exposure and rapid remediation of high-risk issues.”

Michael Bell, Founder & CEO, Suzu Labs supplied this comment:

   “The 245% number is real but the breakdown underneath it matters more than the headline. Only 14% of the malicious traffic Akamai observed originated from Iranian IPs. Russia accounted for 35% and China 28%, which tells you this isn’t just Iranian retaliation. Russia and China are taking a “never let a good crisis go to waste” approach, using the conflict as operational cover to ramp up scanning, credential harvesting, and infrastructure mapping while defenders are focused on the named adversary.

   “The attack mix confirms it. Botnet discovery traffic up 70% and automated reconnaissance up 65% means most of what Akamai is measuring is the setup phase, not the main event. The actual attacks that follow this reconnaissance, using the access and mapping being built right now, will be worse than the current numbers suggest.”

Phillip Wylie, Chief Security Evangelist & Senior Consultant, Suzu Labs follows with this comment:

   “Geopolitical conflict has always created opportunity for cyber threat actors, whether they are nation-state aligned groups, cybercriminals exploiting distraction, or opportunistic attackers taking advantage of heightened uncertainty. What we are seeing now is consistent with historical patterns where global instability increases scanning, credential attacks, and reconnaissance activity as organizations shift attention toward crisis response.

   “What stands out is not just the volume increase but the automation behind it. Attackers are clearly leveraging AI-assisted tooling, botnets, and automated discovery techniques to quickly identify weak points while defenders are distracted. This reinforces the importance of continuous exposure management, strong identity security, and monitoring for abnormal reconnaissance behavior, not just traditional alert-driven detection.

   “Organizations should treat these spikes as a reminder that external events often translate into increased cyber risk. Security teams should prioritize basic defensive discipline such as patching exposed services, enforcing MFA, monitoring for credential abuse, and validating DDoS readiness. In periods of global tension, good cyber hygiene and visibility often make the biggest difference.”

Jacob Warner, Director of IT, Xcape, Inc. had this comment:

   “The recent surge in Iranian cyber activity following Operation Epic Fury highlights a sophisticated “loud vs. quiet” strategic pivot. High-profile “wiper” attacks, where large amounts of data are deleted, on entities like Stryker dominate headlines and cause immediate operational paralysis. Meanwhile, state-sponsored actors are simultaneously executing quiet, long-term espionage campaigns.

   “For security professionals, the danger lies in the “loud” attacks serving as a massive smoke screen, drawing incident response resources away from deep-seated persistence in critical infrastructure.

   “Defenders must look past the immediate carnage of defacements and wipers to hunt for “living off the land” techniques and compromised administrative tools like UEM and MDM platforms. Prioritizing identity security and behavioral analytics is the only way to catch the quiet intruder while the sirens are blaring.

   “In modern conflict, the wiper attack is just a loud invitation to a heist that has been running for months.”

We clearly live in interesting times. That is a bad thing at the moment as threats from threat actors are all around us. Meaning that we all have to be on our toes to counter those threats.