Russian APT expands to iOS to harvest iCloud credentials
Star Blizzard is a Russian state-sponsored APT that targets governments, universities, financial and legal organizations, and think tanks. Proofpoint says the group has added the DarkSword iOS exploit kit and appears to be using it to harvest iCloud credentials and gather intelligence on Apple devices. On March 26 Proofpoint observed a spike in link-based phishing emails that redirected iPhone browsers to the exploit. Researchers found a DarkSword loader on VirusTotal and confirmations on URLScan linking the exploit to Star Blizzard domains.