UNC6748
- Origin
- RU
- Primary motivation
- espionage
- Sophistication
- intermediate
- Resource level
- team
- Actor type
- nation-state
- Profile updated
- 2026-07-07 12:26:58
Targeted industries: media-and-entertainment technology-and-telecommunications
Targeted regions: country_code:sa
Context
UNC6748 targets users in Saudi Arabia through a fake Snapchat website, employing a backdoor known as GHOSTKNIFE for data exfiltration. Their exploitation process initially featured basic obfuscation, which evolved to include anti-debugging measures. The actor primarily leveraged CVE-2025-31277 and CVE-2026-20700 for RCE exploits, but exhibited inconsistencies in exploit support for different iOS versions. Additionally, UNC6748's delivery mechanisms incorporated session storage checks to manage infection attempts.
Exploited vulnerabilities
- CVE-2025-31277 (vulnerability)
- CVE-2026-20700 (vulnerability)
Reports & references
- cloud.google.com — Darksword Ios Exploit Chain (report)