Russian FSB-linked threat actor TA446 (also tracked as COLDRIVER and Star Blizzard) has extended its espionage operations to Apple iOS devices using a leaked exploit kit called DarkSword, marking the group’s first confirmed targeting of Apple mobile platforms. Government agencies, think tanks, academic institutions, financial organizations, and law firms are the primary targets, reached via spear-phishing emails impersonating the Atlantic Council. The public availability of DarkSword on GitHub elevates this beyond a single nation-state campaign: lower-sophistication actors can now access exploit capability previously limited to state-sponsored groups, materially increasing mobile enterprise risk for organizations in these sectors.