Russian hackers are increasingly targeting the smartphones of Ukrainian military personnel and government officials, using both an iPhone exploit kit and Android spyware, Ukraine’s State Service of Special Communications and Information Protection (SSSCIP) said, The Record reported Wednesday. The agency said phones used for military communications have become valuable sources of intelligence.

What Happened

On iOS, SSSCIP highlighted DarkSword, an exploit kit delivered through watering-hole attacks. Attackers compromise legitimate websites, such as news outlets and government pages, and the kit exploits vulnerabilities in Safari and iOS when targets visit. Once on a device, DarkSword collects login credentials, messages, contacts and call history, then removes itself, completing the theft within minutes in what the agency described as a hit-and-run approach.

Security firm Lookout has linked DarkSword to a Russia-aligned actor it tracks as UNC6353, which has used the kit against Ukrainian users since at least late 2025. In those attacks, the group compromised a regional news outlet and a local court website, according to The Record.

RelatedSuspected Chinese Spies Exploited BeyondTrust Remote Support Flaw Since August, Google Says

On Android, a group tracked as UAC-0244 spreads CamelSpy through fake websites impersonating military units and other services. The spyware gathers a phone’s location, SIM card data, contacts, call logs and images. A second group, UAC-0263, uses decoy sites offering bogus air-raid alert and discount apps to deliver BTMOB, malware that gives attackers remote access to the device and lets them steal data.

Why It Matters

Phones are where much of the war’s day-to-day coordination happens. Soldiers and officials use messaging apps to communicate, and a compromised handset can expose contacts, conversations and location in one place. The lures SSSCIP described are tailored to that reality: air-raid alert apps are something many Ukrainians install, and fake military-unit sites play on soldiers’ need for unit information and services.

DarkSword’s design is also built to frustrate investigators. Because it pulls data quickly and erases itself, a victim may have little forensic trace to show what was taken. Delivery through trusted local news and government sites means targets do not need to click an unusual link; visiting a page they already rely on can be enough.

The warning covers three separately tracked groups and three malware families, which suggests the pressure on Ukrainian phones is coming from several directions at once rather than from a single campaign.

Context

The warning comes as overall incident volumes keep rising. Ukraine’s CERT-UA recorded 3,137 cyber incidents in the first half of 2026, about 8% more than in the preceding six months. Mobile devices have been a recurring focus of Russian intelligence collection since the full-scale invasion in 2022, alongside attacks on government networks and critical infrastructure.

What to Watch

The Safari and iOS bugs DarkSword relies on have not been publicly detailed in The Record’s report, so Apple security advisories that address them would be a key signal for iPhone users. Further CERT-UA reports may attribute new activity to UAC-0244, UAC-0263 or UNC6353, and Ukrainian authorities are likely to keep pressing personnel to install apps only from official sources.