Between Two Nerds: Its raining iOS exploit kits!

Summary

Risky Bulletin — Between Two Nerds: "It's Raining iOS Exploit Kits!"

Podcast: Risky Bulletin (Risky Business Media)
Episode: Between Two Nerds: It's raining iOS exploit kits!
Date: March 23, 2026
Hosts: Tom Uren & The Gruk

---

Overview

In this episode, hosts Tom Uren and The Gruk examine two major iOS exploit kits found in the wild—Karuna and Dark Sword—as reported by Google and other cybersecurity vendors. They explore their technical sophistication, real-world deployment, and implications for iOS security. The discussion emphasizes the careful, multi-phase “life cycle” of high-end exploits and what this means (and doesn’t mean) for the typical iOS user.

---

Main Discussion Points & Insights

1. Recent Waves of iOS Exploit Kits ([00:10]–[01:28])

• Karuna Exploit Kit:
  • Found to be a highly sophisticated, multi-year exploit originating from a defense contractor with strong Australian ties.
  • Described as “top notch exploit engineering and a very capable set of truly world class” — Tom Uren ([00:42]).
• Dark Sword Exploit Kit:
  • A more recent kit, less capable and less wide-ranging in version coverage than Karuna.
  • Seen as a lower quality, “knockoff” by comparison — The Gruk quips, “Don’t settle for knockoffs, you don’t know what you’re getting. Buy Australian, have the 'Made in Australia' sticker on it.” ([01:12])

2. Does This Mean iOS Security Has Collapsed? ([01:28]–[02:31])

• Both hosts debunk the idea of a sudden collapse in Apple device security.
• The Gruk: “You listen to [the Karuna deep dive] and you don’t go, like, oh, I guess everyone’s going to be doing this now.” ([02:08])
• It's instead evidence of long-term, high-investment, nation-state-level attack development.

3. The Life Cycle of High-End Exploit Kits ([02:31]–[06:45])

• Initial buyers (often nation-states, e.g. Five Eyes governments) use the exploit kit with extreme caution for high-value specific targets to justify million-dollar costs.

• As the exploits age out (i.e., patched or become less relevant):

  • Kits are sold to progressively less sophisticated or less careful attackers—e.g., Russian groups, then ultimately crypto-criminals.
  • Tom Uren: “Once it had aged out and it was no longer as useful to a state, the seller was probably looking at how can I squeeze a last little bit of value out of this depreciating asset?” ([05:13])

• Economic Model:

  • High prices for nation-states, then “fire sale” leftovers for criminals ($200K as opposed to millions).
  • Cruder operators (crypto criminals) then use the kit indiscriminately, ultimately causing exposure and leading to patches and detection.

4. From Targeted Attacks to Broad Criminal Use ([06:45]–[09:23])

• Crypto criminals used watering hole attacks to capture high-value assets like wallet passphrases.
• Tom Uren: “I can’t think of a better way to turn an exploit into money directly.” ([06:45])
• Karuna represents the “AAA game” in exploit kits—top-tier, heavily engineered.

5. The Dark Sword Exploit Kit: Less Sophisticated, More Accessible ([07:30]–[14:00])

• Saw use by several unrelated groups:
  • Saudi Arabian users were targeted through a Snapchat-themed website.
  • Turkish commercial surveillance vendor (Pars Defense) deployed it in Turkey and Malaysia with more operational security and customizations.
  • Russian state hackers used it to target Ukrainian users, geofencing attacks and leveraging compromised Ukrainian government-themed sites.
• Each group customized the “bare bones” kit differently; e.g., Turkish operators added encryption, operational security features; Russians did little customization but added more data theft features.

6. Notable Failures and Quirks in Attacker OpSec ([13:00]–[15:13])

• Lack of geofencing by some buyers led to earlier detection by researchers.
• Kit came with readable source code, including telling JavaScript file names like rcemodule.js (RCE Module), SBX0 (Sandbox Escape), and PELoader (Privilege Escalation Loader).
  • The Gruk (joking): “There's probably just going to be a lot of false positives because you're going to hit react container element all the time.” ([15:13])
• Rawness of some implementations highlights the difference in professionalism and threat level between buyers.

7. Capabilities of the Implants ([16:03]–[17:04])

• State groups (especially Russian attackers) aimed for broad data theft:
  • WhatsApp, SMS, call logs, contacts, browser state, cookies, photos, health data, device identifiers.
  • Extensive targeting of crypto apps: Coinbase, Ledger, Metamask, Bread Wallet, and more ([16:41]).
• Tom Uren: “I presume this is just the Russian state hackers going, ‘oh, well, I'm doing a bit of hacking, I may as well make some money on the side, I suppose.’” ([17:04])
• The Gruk: “This is what happens when your recruitment pool includes a lot of people with a criminal background.” ([17:16])

8. Operational Choices: JavaScript-Only Implants ([18:19]–[19:52])

• Russian kit ran entirely in the browser (JavaScript), never persisted, grabbed data, sent it out, then exited.
• Good operational security: avoid long-term device infection, harder detection.
  • The Gruk: “It’s incredibly light touch. Except that it isn’t.” ([19:12])
  • Tom Uren: “Once you have their authentication tokens, who cares what they do afterwards? You’re better off not leaving traces...” ([19:52])

9. Implications for Everyday Users ([20:56]–[22:21])

• Key Takeaways:

  • If you update your iOS device promptly, you're likely safe from these particular exploit kits.
  • Lockdown Mode offers additional protection.
  • Main targets are outdated devices and high-value targets (crypto wallet holders, government, journalists).
  • The Gruk: “If you update within the first few days of the update becoming available, I think you would have been safe from all of these.” ([20:56])
  • Don’t store sensitive crypto wallet credentials on your phone.
    • “If you have a crypto phrase, perhaps don’t take a photo of it and store it in your phone. That’s the big picture take-home message.” — Tom Uren ([22:12])
  • The Gruk: “The big picture take-home message is: update your iOS and forget about this.” ([22:21])

• For Between Two Nerds listeners (“the elite of the cyber policy world”), the risks are minimal if good practices are followed.

10. Only Real Worry? The Unseen, Not These Kits ([22:45]–[23:18])

• The Gruk: “I wouldn’t worry about this sort of kit, I’d worry about current ones, which—the ones we don’t know about.”
• Ongoing risk is always the then-unknown, best-in-class exploits that remain undetected.

---

Notable Quotes & Memorable Moments

• On exploit quality:
  “Don’t settle for knockoffs, you don’t know what you’re getting. Buy Australian, have the ‘Made in Australia’ sticker on it.” — The Gruk ([01:12])

• On attackers' ROI:
  “If you’re paying millions of dollars for something, you want to use it for things that justify that expense.” — The Gruk ([03:17])

• On the exploit resale life cycle:
  “You sell it for big money to people who will pay big money, when they get to a point where they're no longer going to buy it... the crypto wallet guys will be like, look, I'll give you $200,000 for it.” — The Gruk ([05:54])

• On operational choices:
  “There’s probably just going to be a lot of false positives because you’re going to hit react container element all the time.” — The Gruk ([15:18])

• On Russian hackers customizing implants:
  “This is what happens when your recruitment pool includes a lot of people with a criminal background.” — The Gruk ([17:16])

• On practical security:
  “If you update within the first few days of the update, I think you would have been safe from all of these.” — The Gruk ([20:56])

• On biggest takeaway:
  “The big picture take home message is: update your iOS and forget about this.” — The Gruk ([22:21])

---

Timeline of Important Segments

• [00:10] — Episode intro and introduction to iOS exploit kits
• [01:12] — Humor on "Made in Australia" exploits; comparisons of kit quality
• [02:31] — Discussion on careful, high-value use of expensive exploit kits
• [03:52] — Operational and economic logic behind exploit kit resale
• [06:45] — Watering hole attacks and direct monetization via crypto theft
• [07:30] — Introduction to Dark Sword and its multiple buyers
• [09:23] — Geofencing and operational security in targeted exploitation
• [13:44] — Turkish surveillance vendor’s customizations
• [16:03] — Enumeration of implant and data theft capabilities
• [18:19] — Innovations (and quirks) of JavaScript-only “light touch” attacks
• [20:56] — Guidance for everyday users: update and use Lockdown Mode
• [22:12] — Crypto wallet security takeaway
• [22:45] — Only real worry is the exploits not yet discovered

---

Final Thoughts

This episode gives an expert-level but accessible walkthrough of how nation-state iOS exploit kits appear, spread, and eventually reach wider criminal distribution. Despite the “flood” of recent disclosures, your own risk remains low if you update your device promptly and don’t store sensitive crypto credentials on your phone. The real danger is always one step ahead: as Tom and The Gruk wryly note, it’s the exploits we don’t yet know about.

---

End of Summary

Transcript

[A]

Foreign,

[B]

this is Tom Uren. I'm here with another between two nerds discussion with the Gruk. G', day Grok, how are you?

[A]

G', day, Tom. Fine, and yourself?

[B]

I'm very well. This week's edition is brought to you by Authentic, the open source identity provider. Find them@goauthentic IO and that's authentic with a K. So Gruk, the last couple of weeks they've been, I guess, pretty big pieces of news related to iOS exploits that have been found in the wild, particularly by Google. So a couple of weeks ago there was the Karuna exploits.

[A]

You go Australia,

[B]

they appear to have been leaked from defense contractor with strong Australian links, I've got to say. And that was like top notch exploit engineering and a very capable set of truly world class.

[A]

Yeah, yeah.

[B]

And then just this week Google has also reported on something called Dark Sword, which is more limited in the number of versions, the versions of iOS that it could exploit.

[A]

It's overall much poorer quality compared to a real authentic Australian made tool chain, you know, so don't settle for knockoffs, you know, you don't know what you're getting

[B]

by Australian have the Made in Australia sticker on it. And so the My first thought is, does this tell us anything? Does it actually mean that iOS security is terrible and has all of a sudden sudden actually gotten gone backwards, that we've got these kits that are right.

[A]

Is this some sort of like watershed event where now it's like the dam has broken? All of the known bad stuff about iOS is out in the open and we've been kept in the dark about the vulnerabilities that we're carrying around and now it's all coming out.

[B]

Yep. Open season on Apple devices.

[A]

Yeah, no, not at all. I think just if you look at the Karuna stuff, like the amount of engineering. So there's a podcast that came out on Risky Business that is like a 90 minute deep dive into the engineering. Yeah. And it's some truly amazing stuff. Like you listen to that, you don't go like, oh, I guess everyone's going to be doing this now.

[B]

I also thought the history of where that exploit kit had been deployed was interesting in that it covered many years of iOS versions and it wasn't detected until in effect, this is my interpretation, that it had been sold on. So it was like the third or the fourth purchaser.

[A]

It wasn't until it got to the criminals who were just going after the crypto wallets.

[B]

Yep. And so that implied to me at least that the initial purchaser had used it very carefully. So it hadn't been picked up by Google who finally detected it because they were using it in a very opsec careful way. So it was. I'm interpreting that to mean that it was very targeted.

[A]

Right. So I would absolutely agree. And I think that it's like it makes sense because if you're paying millions of dollars for something, you want to use it for things that will that justify that expense. I guess in other ways if there's something important enough to you that you would spend a million dollars trying to gain access to it, you probably want to be careful about that.

[B]

You want to get return on investment.

[A]

Yeah. And you want to. There's probably more than one of those things at that point.

[B]

Like you're probably more than one person you want to hack.

[A]

Exactly right. And so you're going to be careful and sparing. You're going to use sort of as much as you need plus one, I guess. Right. Like if you can get away with doing a phishing attack, you'll use a phishing attack. If you can use an N day, you'll use an N Day. If you have to use an iOS O Day, then it's going to be worth it sort of thing. And so yeah, it looks like they were careful probably even for the first. So like there's the authentic purchaser choose the US government and probably some other five eyes nations and it was never detected. Like my understanding is that if it was detected the bugs would be killed but the campaign would not be exposed sort of thing like Google would. They might have the courtesy of informing NSA like we're going to kill your bug. But they're not going to blow the whole campaign. They might give them like 90 days and ET cetera. So it went from there to the Russians and then it went from there. Ultimately it ended up being used by Chinese crypto wallet hackers who very likely did not pay a million dollars for it.

[B]

And I think by that time it was viable for like a relatively small percentage of. Right.

[A]

It was, it was all historic at that point.

[B]

Yeah. So people who hadn't updated had old phones, whatever.

[A]

What that says to me is that while it was a viable nation state tool, it was being sold to nation states at the high price. Once it had aged out and it was no longer as useful to a state, the seller was probably looking at how can I squeeze a last little bit of value out of this depreciating asset? Which is when they would go to anyone.

[B]

Right. So that might be something like you've got an exclusive license to use this thing that we've stolen for X number of years or something or while, you know, n minus one current or something like that maybe. Yeah.

[A]

So like, I mean the way I would say it is you sell it for big money to people who will pay big money when they get to a point where they're no longer going to buy it. Like they're not interested in it anymore because it's old. You then look at anyone who's willing to pay for something that might be valuable to them and you'll probably find, you know, like the crypto wallet guys will be like, look, I'll give you 200,000 for it. Right? Like it's worth something, but not very much. I mean 200,000 is quite a lot of money, but compared to the millions that you were getting before, it's a bit of a, like it's a huge letdown. But yeah, like that's, that's what I would assume would happen. At which point it basically it gets burned because these guys have paid very little money for it and they just want to hit as many things as they can to try and make their 200,000 back and then some and they just.

[B]

Yeah, yeah. And to be clear, the crypto criminals in this case, they had a watering hole attack or they had a watering hole people visiting the site, it would try and grab their crypto wallet passphrases or whatever. And so they had a mechanism to actually turn it from an exploit into money again. And actually. Yeah, yeah. And so that's still a very high value activity actually because there's probably, I can't think of a better way to turn an exploit into money directly. So you know, it's still I guess quite valuable. Now that was Karuna, which is the UBU top tier prime example of.

[A]

That's your triple A game sort of. That's your, your real top end now if you go to like one of the indie level, sort of.

[B]

Yeah. So the, the Next Exploit kit, I guess that was published this week, there's a couple of different variants. I. So the top level name that Google gave it is Dark Sword, which I think may have been in the kit itself somewhere.

[A]

Yes, they talk about comments somewhere. Yeah, yeah.

[B]

And that seems it's more up to date but less capable, less sophisticated one might say. Yes, maybe that's a better word. I mean once you exploit a device, you've exploited it, it's yes or no. It doesn't matter how beautiful it is, I suppose.

[A]

So the interesting there's a number of interesting things. One of them is the number of people who purchased it still seems fairly small. Right. You've got this.

[B]

Right, Right. So there's three different reports that I've seen. There's one from Google Threat Intelligence Group, there's one from Iverify, and there's one from Lookout. So the Google report talks about essentially three different groups using the kit and it seemed like they kind of did their own implant afterwards to some extent at least. So one was Saudi Arabian users targeted via a Snapchat themed website.

[A]

Okay.

[B]

The second one, which they gave a different name was a Turkish commercial surveillance vendor selling it to users in Turkey and Malaysia. And so that that surveillance company is called Pars Defense P A R S. And then the third user was the Russians and they'd also used Karuna and they were targeting people in Ukraine.

[A]

Right. And they ge the IPs to specifically target Ukrainian users. They were using compromised Ukrainian sites, but then they also geofenced the IPs so that only Ukrainian users that hit those Ukrainian sites would be hit. Like to me that says targeted. Like it's a broad target, but it is targeted. Right, Like Ukraine is a target.

[B]

Yeah, yeah. And I mean the websites were purporting to be Ukrainian government as well, so niche stuff. I've got to say I'm a bit surprised that it was geo fenced to Ukraine. But I guess that implies that if you've got a military purpose, it's a

[A]

security thing, I would think. Right. Because you're going to have Google web crawling. Right?

[B]

Okay. Yep, yep.

[A]

Right. And you would want to not send your exploit to Google's web crawler or any of the other web crawlers out there. That's how I would interpret that. Not that it was a politeness thing where they just didn't like in case it's the Polish, we better not hack them. That would go over really badly. It was one of those.

[B]

Well, I was just thinking that if it's a military thing and you've got a military purpose, why, I guess it just saves you filling up your database with stuff that you're not going to is not actionable for what you're trying to do.

[A]

I guess I would agree with that in that you're probably looking to sort of hit only the targets that you want. And I would say that that includes not hitting targets you don't want, such as a Google web crawler or an AI scraper or something like that. So it's a sort of a security mechanism as well. Would be my thing.

[B]

So it's interesting to me this like just looking through the different reports, the very strong vibe you get is it's not as sophisticated, which we'll talk about, I think.

[A]

You know, I'm not saying that there's a problem. Indie developers sort of putting out their own thing. It's good. We want to have an ecosystem where there's a lot of people taking part and sort of there can be a lot of creativity outside of these AAA studios. But you know, but I think it's

[B]

interesting that there was a number of customers immediately, even though it's still a current at the time. Well, I guess iOS 18. So more current.

[A]

It was current at the time, I think.

[B]

Yep.

[A]

Or current. Ish.

[B]

Right. So I think it's interesting that even though it's more current. So it's. And hang on, I think the Google said that they had detected it from November 25th, which is like. Hang on.

[A]

Yeah, 26 came out in September. Right.

[B]

Yeah, yeah, that's. So it's possible that it's the. As soon as you're not current, the aperture of customers opens up.

[A]

Right. I like. I don't imagine a Turkish surveillance vendor is your number one go to customer. If you have this capability, you're probably going to try and sell to someone in the west first. You know how I would parse this? NATO customers. Right, right. Like you're, you're selling, you're selling this thing you expanded to like the. From five eyes to NATO to. At some point it sort of gets resold by someone that you've sold it to. You know, it sort of goes down the chain.

[B]

Right? Yeah. So Google says they first detected it. If I'm reading their timeline. Right. In the Saudi Arabian. The customer targeting Saudi Arabian users.

[A]

See, I bet you they didn't geofence. That was their mistake.

[B]

So I've got to say some of the stuff in the reports is quite amusing.

[A]

As we said that there's these sort of three tiers of use cases. The Turkish Malaysian axis, the Saudi Arabians and then the Russian users. It seems like the Turkish surveillance company put quite a bit of effort into customizing, securing, making it more stealthy, adding functionality. Like they took the sort of bare bones raw exploit kit and they customized it to work properly for their environment and to not be easily detected and to do what they needed it to do.

[B]

Yep, yep. I mean Google says unlike the Saudi activity, this campaign was carried out with more attention to opsec with obfuscation applied to the exploit loader and some of the exploitation stages. They used encryption to encrypt exploits between the server and the victim.

[A]

Yep. That sounds responsible. I would say, like that's what you should be doing.

[B]

Yeah.

[A]

However, like, we can, we can kind of skip the Saudi one because the Russian one is hilarious. I think there's not so much info on the Saudi one, but like the Russian one, it's sort of, it's very bare bones. I think that the, like, when they purchased the kit, they got it complete with source code. So it's going to have like comments, it's going to have usable names, it's going to be clearly like you're going to see clear indications of what everything is. And so just to back up ever so slightly, the way that Lookout and Iverify got involved in this is when the Karuna announcement came out, Lookout went through all of their, like their data sets looking for logs and things like that to see has this thing occurred in our log base. They found a related URL that had almost the exact same, like it had the same components with a small change. And they thought, huh, this might be something. And then they saw that the full URL ended with rcemodule js.

[B]

I think some of the names are great. What else is there?

[A]

See, I think there's probably just going to be a lot of false positives because you're going to hit react container element all the time.

[B]

Yeah. And the other one is S box, S box, SBX0, sandbox escape.

[A]

And then the next one was Peloader, which is privilege Escalation Loader. But all of that said, while they didn't seem to have done any customization on the exploits, they did add a bunch of functionality to the implant.

[B]

Yeah. So there's a list here of what the capabilities are.

[A]

So it does the sort of things that you'd expect. You're getting the WhatsApp data, the SMS database, call history, contacts, Safari history, the bookmarks, the browser state, the cookies, locations, notes, calendars, photos, health, device identifiers, configuration

[B]

preferences, SIM cards, basically everything that's consistent with state espionage. These are all the things you just grab, Right?

[A]

Right. Just absolutely everything, you know, and then it grabs all the other stuff that you expect. Coinbase, Finance Ledger, Trezor Trust Wallet, Metamask, Electrum Blockstream Bread Wallet, Mycelium Samurai Blue Wallet.

[B]

So like, I presume this is just the Russian State hackers going, oh, well, I'm doing a bit of hacking, I may as well make some money on the side, I suppose.

[A]

I think this is what happens when your recruitment pool includes a lot of people with a criminal background, right, like, you go to them, you go like, look, we've got this kit. What we need you to do is customize it and make it ready for deployment. So the guy takes it and rather than going through and changing RCE loader to widget js, he goes through and he goes, ah, I see what it's missing. There's nothing for crypto in here. Why don't I just fix that for you? Right. My initial thought was that the people selling it probably added some implant functionality of their own so that there'd be like a revenue stream in addition to licensing. But it seems that only the Russian one has this one. Only the Russian variant has this capability, which makes me think that it was the operators deploying it who just expanded it.

[B]

Yeah, that seems right. It's only that particular one targeted Ukraine that has that.

[A]

Yeah, I was going to say the one other interesting thing about the way that it works is that it runs entirely in JavaScript, at least the Russian one. I'm not sure I didn't say anything about the others, but it doesn't deploy anything at all. There's no persistence mechanism, it doesn't have any injections, it just runs in JavaScript, collects everything in temp bundles, it exfiltrates it and then it's done. It leaves the device, which is very. That's a very weird way of operating, except it's surprisingly good opsec for people who use RCE loader for a module of their exploit kit. It's incredibly light touch. Except that it isn't.

[B]

Well, I was thinking about that in the context of what you said about recruiting criminals and so perhaps that there's a way of doing things that is still inherited from the good times and that now you've got people operating within that framework of. Well, yeah, no, we don't. We don't do the work to put in.

[A]

Right.

[B]

Persistent implants.

[A]

I mean, once someone's. Once someone's wallet is drained, they're not going to top it up again on the same phone.

[B]

Yeah. And I think a lot of the things that you grab, like account credentials and authentication tokens and stuff like that, so you don't need to necessarily stay on the device.

[A]

Right. Once you have their authentication tokens, who cares what they do afterwards? You're better off not leaving traces, actually, that's the better way to handle it.

[B]

So overall, I think that it seems like a tale of two types of implants or two types of exploit kits here. Where you've got the ubiquit super duper one and then you've got this newer version, not as good, but they're still falling in the same operational paradigm of when they're very, very, very valuable, they're used carefully and with a lot of opsec. As they age out or become less relevant, they're deployed more widely. At that point they get picked up by in both cases, I guess Google. And at that point they're patched. In terms of being like a regular person, I'm not thinking that my threat, my risk has changed at all.

[A]

Because if you update within the first few days of the update becoming available, I think that you would have been safe from all of these.

[B]

And there's also lockdown mode as well.

[A]

Right.

[B]

So I think all the ones I've read, it's basically said if you had lockdown mode there would have had to be extra.

[A]

Yeah, it would not have worked. Look, if you're targeting someone who's on a version behind, they're not on a version behind and using lockdown mode, it's a Venn diagram with no intersection at all. Right. It's pretty safe.

[B]

Now having said that, I am not a crypto person, so I feel particularly. Is it safe? I guess so. I feel like I'm not in that target demographic because that's still a high value target for I don't have my

[A]

personal wealth on my phone. If you're doing a risk assessment, I would say that that's probably the problem that you should look at. Not how well is your phone protected, it's that it's on your phone. Like what is wrong with you?

[B]

So if you have a crypto phrase, perhaps don't take a photo of it and store it in your phone. Is that the. That's the take home message, the big picture take home message.

[A]

The big picture take home message is update your iOS and forget about this. Like it's not. If you listen to between two Nerds, you're one of the smartest people on the planet and you're not a target demographic for this because you update your phone. So I wouldn't worry about it, but

[B]

I kind of think that the listeners of Between2Nerds are amongst the elite of the cyber policy world. Right.

[A]

So look, I wouldn't worry about this sort of kit, I'd worry about current

[B]

ones which the ones we don't know about.

[A]

Oh, good.

[B]

Feels much better.

[A]

Yeah. You know, you're not in the like the sort of second rate cast off, hand me down exploit kit range. You're at the top tier. Bespoke, tailored, top end.

[B]

Right, okay. Yeah, I see the message now. So you and I don't need to worry about it. It's just all our listeners that need to worry about. What a relief.

[A]

Thanks a lot, Tom.

[B]

Thanks, Rock.