Cyber Operations — 2026-03-28
U.S. Government-Origin iPhone Exploit Kit DarkSword Leaked Publicly, Millions of Devices at Risk
A sophisticated iPhone exploit kit called DarkSword, linked to the earlier Coruna toolkit originally developed by L3Harris subsidiary Trenchant for Five Eyes intelligence use, was publicly leaked on GitHub. DarkSword contains exploits capable of compromising iPhones running iOS through version 18.7, affecting hundreds of millions of devices running out-of-date software. Parts of Coruna had earlier migrated to Russian intelligence and Chinese cybercriminals through an intermediary who sold exploits to sanctioned Russian broker Operation Zero for $1.3 million. The public leak dramatically expands the threat surface from a tool originally designed for targeted intelligence operations.
Analysis
This represents a textbook proliferation cascade: tools built by L3Harris/Trenchant for Five Eyes use migrated to Russian intelligence via a sanctioned broker (Operation Zero), then to Chinese cybercriminals, and now to GitHub. Each stage expanded the threat surface by orders of magnitude. The public leak transforms what was a targeted intelligence tool into a commodity weapon accessible to any actor with basic technical skills.
This represents a textbook proliferation cascade: tools built by L3Harris/Trenchant for Five Eyes use migrated to Russian intelligence via a sanctioned broker (Operation Zero), then to Chinese cybercriminals, and now to GitHub. Each stage expanded the threat surface by orders of magnitude. The public leak transforms what was a targeted intelligence tool into a commodity weapon accessible to any actor with basic technical skills.