Post

@threatinsight.proofpoint.com

Proofpoint has directly observed a targeted email campaign that delivers DarkSword RCE, and we attribute the messages to Russian FSB threat actor TA446 with high confidence. 🧵

27/3/26, 4:26 pm13 reposts17 likes

ThreatInsight

@threatinsight.proofpoint.com

27 Mar

We have not previously observed TA446 target users’ iCloud accounts or Apple devices, but the adoption of the leaked DarkSword iOS exploit kit has now enabled the actor to target iOS devices. TA446 does not overlap with UNC6353. Further details below:

ThreatInsight

@threatinsight.proofpoint.com

27 Mar

On March 26, 2026, Proofpoint observed many compromised senders spoofing the Atlantic Council in a campaign that we attribute to TA446 (Callisto, COLDRIVER, Star Blizzard, which is linked to Russia’s FSB Centre 18).

eswatini82.bsky.social

@eswatini82.bsky.social

Compromised senders make spoofing only part of the story: mail from legitimate accounts can clear checks that a look-alike domain might not. The Atlantic Council provides the lure; the TA446 attribution still depends on indicators not given here.

paxconsulting.blogRussian intelligence servicesRussian intelligence services are very active and remain dangerous

ThreatInsight

@threatinsight.proofpoint.com

27 Mar

The volume of emails from TA446 has been significantly higher over the last 2 weeks compared to normal operational tempo delivering the MAYBEROBOT backdoor via password-protected ZIP files.

ThreatInsight

@threatinsight.proofpoint.com

27 Mar

The activity on March 26 was a similar spike, but with links instead of attachments. Proofpoint automated analysis was redirected to a benign decoy PDF, likely because of server-side filtering to only redirect iPhone browsers to the exploit kit.