APT29 watering-hole campaign hits iOS and Android visitors via hacked sites, fake sites and Plerdy supply-chain compromise
Matéria consolidada. Reúne 2 matérias que o Tifon tinha publicado separadamente sobre a mesma história. A IA reescreveu o relatório com o que as 2 fontes trouxeram em 05/11/2026 18:06; os links antigos trazem para cá.
Sekoia disclosed a large-scale watering-hole campaign, discovered in mid-October 2026, which it attributes with moderate-to-high confidence to Russia-linked APT29 (SVR, Cozy Bear, Nobelium, BlueBravo, Midnight Blizzard, The Dukes) (securityaffairs.com). The operation combined hacked websites, cloned sites and a supply-chain compromise of the Ukrainian web analytics provider Plerdy. It delivered fingerprinting and exploitation scripts to iOS and Android users. Victims span the US, Ukraine, Czech Republic, Bulgaria and other countries. Named examples are a US chemical industry association, a European far-right party, a Bulgarian military-linked site and a fake hotel website near the UK Ministry of Defence, possibly meant to target diplomatic visitors including Ukrainian President Zelensky's entourage (securityaffairs.com). Dark Reading describes the same activity as broad, with thousands of mobile users exposed, but follow-on data harvesting limited to visitors profiled as valuable (darkreading.com). All exploit chains used patched n-day vulnerabilities, not zero-days, and none persisted on devices (securityaffairs.com).
Detalhes técnicos
- Delivery: three vectors led to the same payload (securityaffairs.com).
- Injected JavaScript on compromised sites.
- Fake cloned sites impersonating America250 and Raffles London at The OWO.
- A compromised Plerdy analytics script (a.plerdy[.]com), active between August 27 and September 3, 2026 and loaded by thousands of mostly Ukrainian sites.
- Fingerprinting: a script dubbed UltimateFingerprinter was hidden in a 2.3MB minified AngularJS file. It collected 394 fields via 61 collectors, loaded from static[.]flux-telemetry[.]com, before deciding whether to serve exploits (securityaffairs.com). This matches the two-stage model of profiling first and harvesting selectively (darkreading.com).
- Exploit chains (securityaffairs.com):
- Class A targets iOS 16.7 and steals cookies.
- Class B is linked to the commercial surveillance kit DarkSword and targets iOS 18.5. It steals iMessages, WhatsApp/Telegram databases, Keychain, Health data and photos.
- Class C, AndroSnitch, targets Android Chrome 139-145 (excluding 143). It steals cookies and Wi-Fi passwords and deliberately stops on Samsung Galaxy S25 Ultra devices. It resembles Google TAG's 2024 AndroSnatch.
- Exfiltration: stolen data went to ad.starx-net[.]com:8881/telemetry/v12 (securityaffairs.com).
- Attribution basis: backend artifacts match a prior 2025 APT29 watering-hole report, and the framework resembles a 2024 APT29 campaign against Mongolian government sites reported by Google TAG (securityaffairs.com).
Remediação
- All chains target known, patched vulnerabilities, so fully updated iOS and Android devices are not vulnerable. Keep mobile OS and browser patches current (securityaffairs.com).
- Monitor for the indicated infrastructure: a.plerdy[.]com, static[.]flux-telemetry[.]com and ad.starx-net[.]com (securityaffairs.com).
Relatos divergentes
- Level of detail: Dark Reading gives no malware names, exploited vulnerabilities or indicators (darkreading.com). Security Affairs, relaying the Sekoia research, provides these details and is the more detailed and authoritative source here (securityaffairs.com).
- Scale: Dark Reading speaks of thousands of mobile users affected (darkreading.com). Security Affairs cites thousands of sites loading the Plerdy script and gives no victim count (securityaffairs.com). The number of actual victims is unconfirmed.
- Attribution: Security Affairs states moderate-to-high confidence, while Dark Reading states the APT29 attribution without that caveat. The more cautious Sekoia assessment should be treated as authoritative.
Linha do tempo
-
APT29 Compromises Websites to Fingerprint and Harvest Data from Mobile Visitors
ler a análise desta fonte ocultar
APT29, the Russian state-sponsored threat group, has been conducting watering-hole attacks by compromising legitimate websites to target thousands of mobile users. After breaching these sites, the group fingerprints visitors' devices to identify victims of interest, then selectively harvests information from those deemed valuable targets. The campaign appears broad in scale, affecting large numbers of mobile users, though the attackers focus follow-on collection efforts only on select victims after initial profiling.
Technical Details
The reported operation involves two stages: first, compromising websites to serve as watering holes, and second, deploying fingerprinting mechanisms to profile visiting mobile devices before deciding which victims warrant deeper data harvesting. The article does not provide specific technical indicators, malware names, or exploited vulnerabilities.
-
APT29 Watering-Hole Campaign Uses N-Day Exploit Chains to Target iOS and Android Visitors
ler a análise desta fonte ocultar
Sekoia disclosed a large-scale watering hole campaign, discovered mid-October 2026, attributed with moderate-to-high confidence to Russia-linked APT29 (SVR Group, Cozy Bear, Nobelium, BlueBravo, Midnight Blizzard, The Dukes). The operation combined hacked websites, cloned/fake sites, and a supply-chain compromise of Ukrainian web analytics provider Plerdy to deliver mobile fingerprinting and exploitation scripts to iOS and Android users. Victims span the US, Ukraine, Czech Republic, Bulgaria and other countries, including a US chemical industry association, a European far-right party, a Bulgarian military-linked site, and a fake hotel website near the UK Ministry of Defence used possibly to target diplomatic visitors including Ukrainian President Zelensky's entourage. All exploit chains relied on patched n-day vulnerabilities, not zero-days, and none persisted on devices.
Technical Details
Three delivery vectors converged on the same payload: injected JavaScript on compromised sites, fake cloned websites (impersonating America250 and Raffles London at The OWO), and a compromised Plerdy analytics script (a.plerdy[.]com) active between August 27 and September 3, 2026, loaded by thousands of mostly Ukrainian sites. A fingerprinting script dubbed UltimateFingerprinter, hidden in a 2.3MB minified AngularJS file, collected 394 fields via 61 collectors from static[.]flux-telemetry[.]com before deciding whether to serve exploits. Three exploit chains were identified: Class A (iOS 16.7, cookie theft), Class B — linked to the commercial surveillance kit DarkSword (iOS 18.5, full device data including iMessages, WhatsApp/Telegram databases, Keychain, Health data, photos), and Class C (AndroSnitch, Android Chrome 139-145 excluding 143, stealing cookies and Wi-Fi passwords, with a special stop on Samsung Galaxy S25 Ultra devices). AndroSnitch resembles Google TAG's 2024 AndroSnatch. Stolen data was exfiltrated to ad.starx-net[.]com:8881/telemetry/v12. Attribution ties include backend artifacts matching a prior 2025 APT29 watering hole report and framework similarities to a 2024 APT29 campaign against Mongolian government sites (per Google TAG).
Remediation
All exploit chains target known, patched vulnerabilities rather than zero-days; fully updated iOS and Android devices are not vulnerable. Organizations should ensure mobile OS and browser patches are current and monitor for the indicated infrastructure.