import "hash"

rule bulwark_https_bulwarkblack_com_darksword_ios_exploit_kit_russian_hackers_weaponize_six_vulnerabi
{
    meta:
        author = "Bulwark Black LLC"
        source = "https://bulwarkblack.com/darksword-ios-exploit-kit-russian-hackers-weaponize-six-vulnerabilities-for-full-iphone-takeover/"
        description = "Auto-extracted indicators. Verify before use; not a behavioral detection rule."
        generated = "2026-08-27T05:23:31Z"
        tlp = "TLP:CLEAR"
        indicator_count = "13"
    strings:
        $s0 = "cdncounter.net" ascii wide nocase  // Domains
        $s1 = "e5.malaymoil.com" ascii wide nocase  // Domains
        $s2 = "malaymoil.com" ascii wide nocase  // Domains
        $s3 = "sahibndn.io" ascii wide nocase  // Domains
        $s4 = "shapelie.com" ascii wide nocase  // Domains
        $s5 = "sqwas.shapelie.com" ascii wide nocase  // Domains
        $s6 = "static.cdncounter.net" ascii wide nocase  // Domains
        $s7 = "systemgroup.com" ascii wide nocase  // Domains
        $s8 = "https://static.cdncounter.net/assets/index.html" ascii wide nocase  // URLs
        $s9 = "https://static.cdncounter.net/widgets.js?uhfiu27fajf2948fjfefaa42"></script&gt" ascii wide nocase  // URLs
        $s10 = "62.72.21.10" ascii wide nocase  // IPv4
        $s11 = "72.60.98.48" ascii wide nocase  // IPv4
    condition:
        any of ($s*) or
        hash.sha256(0, filesize) == "2e5a56beb63f21d9347310412ae6efb29fd3db2d3a3fc0798865a29a3c578d35"
}