Unc6353 — Threat Actor Profile, Campaigns & Targets

Threat entity extracted from intelligence sources

Frequency
8
occurrences
First Seen
March 3, 2026
Last Seen
July 12, 2026

Unc6353 is a apt_group tracked across 3 threat clusters and 8 intelligence report mentions on ThreatCluster. First observed March 3, 2026; most recent activity July 12, 2026.

Related Threat Clusters

  • DarkSword iOS Exploit Chain Targets Mobile Devices Globally

    The Google Threat Intelligence Group has identified DarkSword, a full-chain iOS exploit affecting versions 18.4 to 18.7. This exploit leverages multiple zero-day vulnerabilities, including CVE-2025-31277 and…

    2 articles · Updated July 11, 2026
  • CISA Includes Coruna Exploit Kit iOS Vulnerabilities in KEV List

    CISA has added 23 vulnerabilities exploited by the Coruna exploit kit targeting iOS versions 13 to 17.2.1 to its Known Exploited Vulnerabilities (KEV) list. The exploit kit is associated with nation-state actors,…

    2 articles · Updated March 6, 2026
  • Coruna iOS Exploit Kit Targets Multiple Threat Actors

    The Coruna iOS exploit kit has emerged, targeting Apple iPhone models running iOS 13.0 to 17.2.1. It includes five exploit chains and 23 exploits, with advanced techniques that are non-public. Various threat actors,…

    372 articles · Updated March 3, 2026

Recent Intelligence Reports

  • Darksword — www.lookout.com · July 12, 2026
  • Russia-linked hackers used new Darksword tool to hack Ukrainians' iPhones, stealing data ... — Pravda.Ua · March 19, 2026
  • Lookout Uncovers DarkSword iOS Exploit Chain, Exposing a New Era of Mobile Threats — Morningstar · March 18, 2026
  • Lookout Uncovers DarkSword iOS Exploit Chain, Exposing a New Era of Mobile Threats — Streetinsider · March 18, 2026
  • U.S. military contractor likely built iPhone hacking tools used by Russian spies in Ukraine — Techcrunch · March 10, 2026
  • 3 Apple flaws from Coruna exploit kit added to CISA vulnerability list | news — Scmagazine · March 6, 2026
  • Coruna Exploit Kit Leveraging 23 Vulnerabilities Compromised Thousands of iPhones — Cyberpress · March 4, 2026
  • Coruna: The Mysterious Journey of a Powerful iOS Exploit Kit — Mandiant · March 3, 2026

CVSS v3.1 Breakdown