APT29 watering hole campaign serves patched n-day iOS and Android exploit chains via hijacked Plerdy tracker and lookalike sites
Matéria consolidada. Reúne 2 matérias que o Tifon tinha publicado separadamente sobre a mesma história. A IA reescreveu o relatório com o que as 6 fontes trouxeram em 05/11/2026 00:01; os links antigos trazem para cá.
Fontes: helpnetsecurity.com ↗ infosecurity-magazine.com ↗ thehackernews.com ↗ gbhackers.com ↗ bleepingcomputer.com ↗ sekoia.com ↗
Sekoia (sekoia.com) disclosed a large-scale watering hole campaign, discovered in mid-October 2026 and attributed with moderate-to-high confidence to APT29 (Midnight Blizzard, Cozy Bear, linked to Russia's SVR). It uses compromised legitimate sites, lookalike proxy domains and a supply-chain compromise of the Ukrainian analytics service Plerdy. A fingerprinting script, UltimateFingerprinter, profiles each visitor and the C2 then serves a platform-specific, zero-interaction n-day exploit chain for iOS or Android Chrome. Victims include a Ukrainian gas producer, a US chemical industry trade association, a Bulgarian military-related site and a far-right Czech political party site, plus fake pages impersonating America250 and Raffles London at The OWO (bleepingcomputer.com, infosecurity-magazine.com). All exploited flaws were already patched, and the payloads establish no persistence, so a reboot stops the activity until the next visit. Sekoia states that fully updated devices are not at risk and is working with national CERTs, including CERT-UA, to identify victims and disrupt the infrastructure (helpnetsecurity.com). The Hacker News (thehackernews.com) codenames the campaign Poisoned Source and also covers separate, related iPhone exploit-kit activity.
Entenda a falha
A vulnerabilidade
Twelve CVEs appear in n-day exploit chains served by an APT29 watering hole, with no user interaction beyond visiting a page. The most complete chain (Class B, iOS 18.5, the DarkSword kit) combines CVE-2025-43529 (RCE), PAC bypass CVE-2026-20700, sandbox escapes CVE-2025-14174 and CVE-2025-43510, and kernel read/write CVE-2025-43520. Class A (iOS 16.7, cookie theft) uses CVE-2025-43529 with PAC bypass CVE-2024-27834. Class C hits Chrome for Android 139-145 (except 143) with renderer RCE CVE-2026-3910 and Adreno GPU driver sandbox escape CVE-2025-27038. CVE-2024-27808, CVE-2024-27833, CVE-2025-31277 and CVE-2025-24201 were dead code or unused alternates. The attacker only needs the victim to load a compromised or cloned page. Apple and Google have patched all of them, including backports; up-to-date devices are not at risk.
Como funciona
A visitor opens a legitimate site that was modified (injected script, a tampered JavaScript library, or the compromised Plerdy tracker main.js) or a lookalike reverse-proxy domain that patches the HTML on the fly. When the page finishes loading, a small script pulls in UltimateFingerprinter, which collects 394 fields through 61 collectors. The delivery server only checks basics such as a plausible phone screen size and touch points, plus OS or browser version, then serves the matching chain. The chain gets code execution in the browser, bypasses pointer authentication on iOS, escapes the sandbox and, on iOS, reaches kernel read/write. The final payload sends data to a telemetry endpoint and installs no persistence, so a reboot stops it.
Por que é vulnerável
The articles do not describe the root cause of each CVE. What they establish is that every flaw is an already patched n-day, so exposure comes from devices that have not applied iOS, Chrome or Android updates. The chains stack weaknesses: code execution, then PAC bypass, sandbox escape and kernel access. Delivery abused trust in web content: a third-party tracker script on a.plerdy[.]com was altered for one week, and how Plerdy was compromised is not stated. Sekoia notes that packaged n-day chains lower the cost of advanced mobile exploitation.
Como foi descoberta
Sekoia's Threat Detection & Research team found the campaign in mid-October 2026, starting from a malicious JavaScript inclusion on a Ukrainian gas producer's website. Further analysis revealed other compromised sites, lookalike proxy domains and requests from sites sharing the Plerdy SEO Tracker. Sekoia describes DarkSword as a suspected commercial surveillance vendor kit uploaded to VirusTotal in September 2026, and says APT29 likely obtained the exploits from a third party. Google documented DarkSword in March 2026. Sekoia's post is dated 29 October, while Infosecurity Magazine says it was published on 4 November. Sekoia is working with national CERTs, including CERT-UA.
PoC existente, privada
O exploit existe, mas quem o tem não o publicou.
Working exploit chains exist and were used in real attacks: Sekoia retrieved three (iOS Class A cookie theft, the full DarkSword iOS chain, and an Android Chrome chain delivering AndroSnitch). The articles point to no published repository or write-up with a working demonstration, only the DarkSword kit uploaded to VirusTotal, so access is treated as private. Separately, the Coruna kit is reported to have leaked and DarkSword-derived chains are used by other actors, which widens the pool of attackers. The chains are weaponized and active against unpatched devices, so updating is urgent.
Explicação gerada por IA a partir da matéria e dos artigos, em 05/11/2026 00:16.
Detalhes técnicos
- Infection vectors: direct JavaScript injection, AiTM-like reverse-proxy lookalike domains (america250[.]holiday, theowo[.]club) and the Plerdy SEO tracker (a.plerdy[.]com). The tracker file was modified between 27 August and 3 September 2026 and is loaded by thousands of sites, mostly Ukrainian and many military or defense-related (sekoia.com, gbhackers.com).
- Fingerprinter: UltimateFingerprinter is hidden behind about 2.3 MB of dead AngularJS code, which may be meant to hinder LLM-based analysis. It collects 394 fields through 61 collectors and only receives an exploit if basic device-type checks pass (gbhackers.com, sekoia.com).
- Infrastructure: static.flux-telemetry[.]com, edge-ord.clouds-stacks[.]com, ad.starx-net[.]com, ads-it-assets[.]com, cdn.adv-static[.]com, wpvortex-mod[.]com and assets-int[.]com (sekoia.com). Exfiltration goes to ad.starx-net[.]com:8881/telemetry/v12 (gbhackers.com, thehackernews.com).
- Class A (iOS 16.7, cookie theft): CVE-2025-43529 (RCE) plus CVE-2024-27834 (PAC bypass). Dead code for CVE-2024-27808 and CVE-2024-27833 was also found.
- Class B (iOS 18.5, full DarkSword chain): CVE-2025-43529, CVE-2026-20700 (PAC bypass), CVE-2025-14174 and CVE-2025-43510 (sandbox escape), and CVE-2025-43520 (kernel read/write). It exfiltrates SMS, iMessage, Mail, WhatsApp and Telegram databases, Keychain, Wi-Fi PSKs, contacts, Safari cookies, location, Health data and photos. Alternate exploits CVE-2025-31277 and CVE-2025-24201 are in the kit but unused (sekoia.com).
- Class C (Android Chrome 139–145, excluding 143): CVE-2026-3910 (renderer RCE) chained with CVE-2025-27038 (Adreno GPU driver sandbox escape), delivering AndroSnitch shellcode. It steals Chrome cookies, saved passwords, history and Wi-Fi configurations. The chain aborts on a Samsung Galaxy S25 Ultra (SM-S938B) (thehackernews.com).
- Lineage: CVE-2025-43529 is tied to the DarkSword exploit kit, used by multiple groups since at least November 2025 (bleepingcomputer.com). AndroSnitch resembles ANDROSNATCH, a Chrome cookie stealer Google documented in August 2024 in a suspected APT29 campaign against a Mongolian government site using CVE-2024-5274 and CVE-2024-4671 (thehackernews.com). Sekoia assesses APT29 likely obtained the exploits from a third party (infosecurity-magazine.com).
- Attribution basis: Ukraine, US and Europe victimology, infrastructure overlap with a 2025 APT29 watering hole campaign, similarities to the 2024 Mongolia operation reported by Google TAG, and the targeting of European political parties, which fits Mandiant's 2024 WINELOADER reporting on German parties (gbhackers.com, helpnetsecurity.com). Unlike the 2024 Mongolia campaign, which used a hard-coded target filter, this one harvests cookies from any visitor (infosecurity-magazine.com).
- Targeting notes: An Australian medical clinic site with no strategic value may have been compromised to target specific individuals (low confidence). Open-source reporting ties the Raffles London lookalike to Ukrainian President Zelensky's stay on 14 October. Microsoft separately reported APT29 hijacking hotel and conference Wi-Fi over the summer to steal Microsoft 365 credentials (helpnetsecurity.com).
- Related but distinct activity: iVerify, Report URI and Zimperium zLabs describe the criminal DeadTag operation, which hijacks over 660 expired domains behind old analytics and ad tags. It redirects real iPhone visitors, after bot filtering, to Coruna (iOS 13–17.2.1) or DarkSword P7 (iOS 18.4–18.7). Zimperium counted 608 Coruna-delivering domains as of October 2026, and malvertising such as a World Cup-themed Instagram ad is also used (thehackernews.com).
Remediação
- Apple and Google have patched all exploited vulnerabilities, including backports to older iOS releases. Apple fixed the DarkSword-related flaws by iOS 26.3 (bleepingcomputer.com, gbhackers.com). Apply the latest iOS and Chrome/Android updates.
- Block the named domains and hunt for related starx-net, flux-telemetry and clouds-stacks infrastructure (gbhackers.com).
- Review any use of the Plerdy tracker, especially its state between 27 August and 3 September 2026.
- Sekoia's own report contains further recommendations that are truncated in the available text.
Relatos divergentes
- Scope of DarkSword: gbhackers.com cites Google's March 2026 report that DarkSword supports iOS 18.4–18.7 and was used by the suspected Russian cluster UNC6353 against Ukrainian sites. The sources describing this campaign (sekoia.com, bleepingcomputer.com, infosecurity-magazine.com) only document the chain used against iOS 18.5.
- Campaign boundaries: The headline of thehackernews.com says the campaign "expands" to DeadTag and Coruna, but its body describes DeadTag, Coruna and DarkSword P7 as related but distinct campaigns, and Sekoia's APT29 attribution does not cover them.
- Zelensky link: sekoia.com calls the link to Zelensky's recent stay "possible", while helpnetsecurity.com gives 14 October from open-source reporting. Treat it as unconfirmed.
- Exploit lineage in 2024: gbhackers.com describes the Mongolia campaign's exploits as similar to NSO Group and Intellexa n-days, while thehackernews.com names CVE-2024-5274 and CVE-2024-4671.
Linha do tempo
-
APT29 Watering-Hole Campaign Uses N-Day iOS/Android Exploit Chains Against Ukraine-Linked and Diplomatic Targets
The article adds that an Australian medical clinic site with no strategic value was likely compromised to target specific individuals (low confidence), that open-source reporting ties the Raffles London at The OWO lookalike to a visit by Ukrainian President Zelensky on October 14, and that Microsoft separately reported APT29 spending months hijacking hotel and conference Wi-Fi networks over the summer to steal Microsoft 365 credentials. It also includes Sekoia's closing assessment that reuse of packaged n-day mobile exploit frameworks like DarkSword lowers the barrier for state-sponsored mobile exploitation and will likely proliferate.
ler a análise desta fonte ocultar
The article adds that an Australian medical clinic site with no strategic value was likely compromised to target specific individuals (low confidence), that open-source reporting ties the Raffles London at The OWO lookalike to a visit by Ukrainian President Zelensky on October 14, and that Microsoft separately reported APT29 spending months hijacking hotel and conference Wi-Fi networks over the summer to steal Microsoft 365 credentials. It also includes Sekoia's closing assessment that reuse of packaged n-day mobile exploit frameworks like DarkSword lowers the barrier for state-sponsored mobile exploitation and will likely proliferate.
Sekoia details a watering-hole operation attributed with moderate-to-high confidence to APT29 (Midnight Blizzard, Russia's SVR), combining compromised websites, lookalike domains and a hijacked Ukrainian analytics service (Plerdy) to deliver platform-specific n-day exploit chains to iOS and Android visitors without any user interaction. Targets include a Ukrainian gas producer, a US chemical industry trade group, a Bulgarian military-related site, a far-right European political party, and lookalike pages of America250 and Raffles London at The OWO, a luxury hotel near the UK Ministry of Defence that open-source reporting ties to a stay by Ukrainian President Volodymyr Zelensky on October 14. An Australian medical clinic with no obvious strategic value may have been used to target specific individuals, Sekoia assesses with low confidence. Every exploited flaw had already been patched, and the article also notes that Microsoft reported APT29 hijacking hotel and conference Wi-Fi networks over the summer to steal Microsoft 365 credentials.
Technical Details
iPhones on iOS 16.7 are hit via CVE-2025-43529 and CVE-2024-27834 to steal Safari cookies; iOS 18.5 devices face the full DarkSword chain (CVE-2025-43529, CVE-2026-20700, CVE-2025-14174, CVE-2025-43510, CVE-2025-43520) extracting SMS, iMessage, WhatsApp, Telegram data, Keychain passwords, location, health data and photos. Android devices on Chrome 139–145 (excluding 143) are targeted via CVE-2026-3910 and the Adreno GPU driver flaw CVE-2025-27038, grabbing cookies, saved logins, history and Wi-Fi passwords. No payload persists after exfiltration. Attribution rests on infrastructure overlaps with a 2025 APT29 campaign, similarities to the 2024 APT29 campaign against Mongolian government sites confirmed by Google TAG, and a Ukraine-centered victim list.
Remediation
All vulnerabilities in the chains were already patched before the campaign began; Sekoia stresses that fully updated devices are not at risk. The firm is working with national CERTs, including CERT-UA, to identify victims and disrupt the infrastructure.
-
APT29 Watering Hole Campaign Targets iOS 16.7–18.5 and Android Chrome via Patched N-Day Exploits
Infosecurity Magazine's coverage adds that the DarkSword-based exploit chain specifically targeted **iOS 18.5** (in addition to the iOS 16.7 cookie-theft chain), a detail not reflected in the known report's affected-products range of iOS 16.0-17.4, and confirms the payloads established no persistence on compromised devices. It also reiterates that Sekoia assesses APT29 likely obtained the exploits from a third party, consistent with the DarkSword/CSV link already documented.
ler a análise desta fonte ocultar
Infosecurity Magazine's coverage adds that the DarkSword-based exploit chain specifically targeted iOS 18.5 (in addition to the iOS 16.7 cookie-theft chain), a detail not reflected in the known report's affected-products range of iOS 16.0-17.4, and confirms the payloads established no persistence on compromised devices. It also reiterates that Sekoia assesses APT29 likely obtained the exploits from a third party, consistent with the DarkSword/CSV link already documented.
Sekoia research covered by Infosecurity Magazine confirms a large-scale APT29 (Midnight Blizzard/Cozy Bear) watering hole campaign discovered in mid-October 2026, using compromised legitimate sites, lookalike proxy domains and a week-long supply-chain compromise of Ukrainian analytics tool Plerdy to serve device-fingerprinted exploit chains to visitors. The chains targeted iOS 16.7 and iOS 18.5 (the latter via the suspected commercial-surveillance DarkSword kit) and Android Chrome 139–145 (excluding 143), stealing cookies, device data and Wi-Fi passwords with no persistence mechanism and no user interaction required. All exploited vulnerabilities are n-days already patched, meaning fully updated devices are not at risk. Victims included Ukrainian energy, military and defense-related sites, a US chemical trade association, a Czech far-right movement and a Bulgarian military-linked site, plus lookalike domains impersonating America250 and a London hotel.
Technical Details
Exploit chains used: CVE-2025-43529, CVE-2024-27834, CVE-2026-20700, CVE-2025-14174, CVE-2025-43510, CVE-2025-43520, CVE-2026-3910, and CVE-2025-27038. Unlike a 2024 Google-reported APT29 campaign against Mongolian government sites that used a hardcoded victim filter, this campaign applied no such filter and collected cookies from any visitor. Payloads did not establish persistence on compromised devices.
Remediation
Sekoia states that users running fully up-to-date operating systems are not at risk from any of the exploit chains used in this campaign.
-
APT29-Linked Watering Hole Campaign Expands: DeadTag and Coruna Exploit Kits Target iPhones via Expired Ad Domains
This article adds that related but distinct campaigns are distributing evolved **DarkSword P7** and **Coruna** exploit kits via malvertising and a criminal operation called **DeadTag**, which uses over 660 expired/re-registered domains behind old analytics tags to zero-click compromise iPhones without requiring any user action; Zimperium zLabs counted 608 Coruna-delivering domains as of October 2026. It also reveals the Android exploit chain explicitly excludes Samsung Galaxy S25 Ultra devices (model SM-S938B) from exploitation, and links the **AndroSnitch** tool's naming and design to **ANDROSNATCH**, a Chrome cookie-stealer Google documented in an August 2024 suspected APT29 campaign against a Mongolian government site using CVE-2024-5274 and CVE-2024-4671, reinforcing the narrative of continued reuse of commercial surveillance vendor exploit frameworks by state-sponsored actors.
ler a análise desta fonte ocultar
This article adds that related but distinct campaigns are distributing evolved DarkSword P7 and Coruna exploit kits via malvertising and a criminal operation called DeadTag, which uses over 660 expired/re-registered domains behind old analytics tags to zero-click compromise iPhones without requiring any user action; Zimperium zLabs counted 608 Coruna-delivering domains as of October 2026. It also reveals the Android exploit chain explicitly excludes Samsung Galaxy S25 Ultra devices (model SM-S938B) from exploitation, and links the AndroSnitch tool's naming and design to ANDROSNATCH, a Chrome cookie-stealer Google documented in an August 2024 suspected APT29 campaign against a Mongolian government site using CVE-2024-5274 and CVE-2024-4671, reinforcing the narrative of continued reuse of commercial surveillance vendor exploit frameworks by state-sponsored actors.
Sekoia researchers Amaury-Jacques Garçon and Félix Aime detail a large-scale watering hole campaign, codenamed Poisoned Source, attributed to APT29, that compromises legitimate websites, uses lookalike domains, and supply-chain infected the Plerdy SEO Tracker to deliver platform-specific N-day exploit chains to iOS and Android visitors. The campaign uses three exploit classes (A, B, C) targeting iOS 16.7, iOS 18.5 via the DarkSword kit, and Android Chrome 139-145 via AndroSnitch, exfiltrating cookies, messaging data, Wi-Fi passwords, and full device data to ad.starx-net[.]com:8881/telemetry/v12. Notably, the Android chain checks for a Samsung Galaxy S25 Ultra (SM-S938B) model identifier and aborts exploitation if matched. Separately, iVerify, Report URI, and Zimperium zLabs describe related but distinct campaigns distributing evolved DarkSword P7 and Coruna exploit kits via malvertising (including a World Cup-themed Instagram ad) and a criminal campaign called DeadTag, which hijacks over 660 expired domains behind old analytics/ad tags to silently deliver zero-click iPhone spyware.
Technical Details
AndroSnitch is named for its similarity to ANDROSNATCH, a Chrome cookie-stealer Google documented in August 2024 tied to a suspected APT29 campaign against a Mongolian government website using CVE-2024-5274 and CVE-2024-4671, confirming continued reuse of Commercial Surveillance Vendor (CSV) mobile exploit frameworks by state-sponsored actors. The DeadTag campaign filters bots and automated scanners before redirecting real iPhone visitors to the Coruna kit (iOS 13–17.2.1) or DarkSword P7 (iOS 18.4–18.7), compromising the browser with no user interaction required. Zimperium zLabs found 608 domains delivering Coruna-family code as of October 2026, noting Coruna, originally a nation-state tool, leaked and is now used broadly; researcher Santiago Rodriguez found byte-identical legacy Coruna payloads across configurations and a distribution footprint spanning dating portals, AI-companion platforms, crypto promotions, streaming services, and compromised sites using hidden iframes.
Remediation
Users should keep iOS and Android devices updated to the latest security patches, avoid opening links in in-app browsers when directed to use Safari/Chrome externally (a known lure tactic), and organizations should monitor for the identified infrastructure including ad.starx-net[.]com and the over 660 DeadTag-associated expired domains.
-
APT29 Watering-Hole Campaign Uses 'UltimateFingerprinter' Script and DarkSword Kit, Linked to Prior Mongolia and German Party Operations
This article adds technical depth to the known APT29 watering-hole campaign: it names the fingerprinting payload 'UltimateFingerprinter' (2.3MB of padding AngularJS code, 394 fields via 61 collectors), identifies the C2 exfiltration endpoint ad.starx-net[.]com:8881/telemetry/v12, names the lookalike domains america250[.]holiday and theowo[.]club and the compromised tracker domain a.plerdy[.]com, and references additional hunting domains (flux-telemetry, clouds-stacks). It also cites Google TAG's March 2026 report linking the DarkSword exploit chain to commercial surveillance vendors and the suspected Russian cluster UNC6353, and draws historical parallels to APT29's 2024 Mongolia watering-hole campaign (which used NSO Group/Intellexa-like n-days but a hard-coded target list) and to Mandiant's 2024 WINELOADER campaign against German political parties, reinforcing the attribution pattern of targeting European political parties.
ler a análise desta fonte ocultar
This article adds technical depth to the known APT29 watering-hole campaign: it names the fingerprinting payload 'UltimateFingerprinter' (2.3MB of padding AngularJS code, 394 fields via 61 collectors), identifies the C2 exfiltration endpoint ad.starx-net[.]com:8881/telemetry/v12, names the lookalike domains america250[.]holiday and theowo[.]club and the compromised tracker domain a.plerdy[.]com, and references additional hunting domains (flux-telemetry, clouds-stacks). It also cites Google TAG's March 2026 report linking the DarkSword exploit chain to commercial surveillance vendors and the suspected Russian cluster UNC6353, and draws historical parallels to APT29's 2024 Mongolia watering-hole campaign (which used NSO Group/Intellexa-like n-days but a hard-coded target list) and to Mandiant's 2024 WINELOADER campaign against German political parties, reinforcing the attribution pattern of targeting European political parties.
Sekoia provides further technical detail on the APT29 (Midnight Blizzard) watering-hole campaign, revealing that all three infection vectors—direct JavaScript injection, lookalike/reverse-proxy domains (america250[.]holiday, theowo[.]club), and the compromised Plerdy SEO tracker—load a fingerprinting script dubbed UltimateFingerprinter, hidden behind roughly 2.3MB of dead AngularJS code that may be designed to hinder LLM-based analysis. The script collects 394 data points via 61 collectors and only receives an exploit from the C2 server if basic device checks pass. Google's Threat Intelligence Group separately disclosed in March 2026 that the DarkSword iOS exploit chain (supporting iOS 18.4–18.7, using six vulnerabilities, several exploited as zero-days) has been adopted by commercial surveillance vendors and by UNC6353, a suspected Russian espionage cluster that used it against Ukrainian sites. Sekoia also ties the current campaign's framework to APT29's 2024 watering-hole operation against Mongolian government sites, which used n-day exploits similar to those of NSO Group and Intellexa but only targeted a hard-coded list of webmail/login sites, unlike the current campaign which harvests any cookie. A compromised far-right Czech political party site fits APT29's documented pattern of targeting European political parties, as seen in Mandiant's 2024 reporting on the WINELOADER phishing campaign against German parties.
Technical Details
All exploit chains exfiltrate data to ad.starx-net[.]com:8881/telemetry/v12 and establish no persistence. The Plerdy supply-chain compromise modified a.plerdy[.]com's tracker file between August 27 and September 3, 2026, affecting sites including military and defence-equipment pages. Apple patched all DarkSword-related flaws by iOS 26.3.
Remediation
Defenders should patch iOS and Chrome, block the named domains, and hunt for related starx-net, flux-telemetry, and clouds-stacks infrastructure. Google recommends Lockdown Mode where updates cannot be applied, and network teams should audit any use of the Plerdy tracker. Sekoia is coordinating with affected countries' CERTs on victim identification and infrastructure disruption.
-
APT29 Runs Watering-Hole Campaign Using N-Day iOS/Android Zero-Click Exploit Chains
ler a análise desta fonte ocultar
Sekoia researchers report a large-scale watering hole campaign attributed with moderate-to-high confidence to APT29 (Midnight Blizzard), targeting iOS and Android users through compromised legitimate sites and lookalike domains in the U.S., Ukraine, the Czech Republic, and Bulgaria. Victims visiting a Ukrainian gas producer, a U.S. chemical industry trade association, a Bulgarian military-related site, or fake pages impersonating America250 and Raffles London at The OWO were served JavaScript that profiled their device and browser before a C2 server delivered a platform-specific zero-click n-day exploit chain. The attackers also compromised the Ukrainian analytics service Plerdy, modifying its SEO tracker loaded by thousands of sites, mostly in Ukraine, between August 27 and September 3. The exploit chains extracted Safari cookies, WhatsApp and Telegram databases, Keychain credentials, location data, photos, Chrome cookies, login data, browsing history, and saved WiFi credentials, with no persistence established, meaning a device reboot halts the activity until the next visit.
Technical Details
On iOS 16.7: CVE-2025-43529 and CVE-2024-27834 target Safari cookies. On iOS 18.5: CVE-2025-43529, CVE-2026-20700, CVE-2025-14174, CVE-2025-43510, and CVE-2025-43520 harvest WhatsApp/Telegram databases, Keychain credentials, location, and photos. On Chrome for Android versions 139–145 (excluding 143): CVE-2026-3910 and CVE-2025-27038 are used alongside the AndroSnitch tool to collect cookies, login data, browsing history, and saved WiFi credentials. CVE-2025-43529 is linked to the DarkSword exploit kit, used by multiple threat groups since at least November 2025. Four additional vulnerabilities were found in unreachable code or alternate exploit paths but were not actively used. Attribution to APT29 is based on similarities to past watering-hole operations, infrastructure overlaps, and a compromised site a partner linked to a 2025 APT29 campaign.
Remediation
Apple and Google have patched all vulnerabilities exploited in this campaign, including fixes backported to older iOS releases. Users are advised to apply the latest available security updates for their iOS and Android devices.
-
APT29 Runs Watering Hole Campaign Using N-Day iOS/Android Exploit Chains and Plerdy Supply-Chain Compromise
ler a análise desta fonte ocultar
Sekoia disclosed a large-scale watering hole campaign, discovered mid-October 2026, attributed with moderate-to-high confidence to APT29 (Midnight Blizzard, Cozy Bear, The Dukes), linked to Russia's SVR. The campaign compromised or cloned high-profile websites in the US, Ukraine, Czech Republic, and Bulgaria, and included a one-week supply-chain compromise (27 August–3 September 2026) of the Ukrainian web analytics service Plerdy, exposing thousands of sites, mostly Ukrainian military/defense-related, to the exploit kit. Three infection vectors (direct JS injection, AiTM-like lookalike domains, and the Plerdy supply-chain compromise) deliver a fingerprinting script, UltimateFingerprinter, that profiles visitor devices and serves platform-specific n-day exploit chains without user interaction, exfiltrating iOS cookies/full device data or Android Chrome data and Wi-Fi passwords. Notable AiTM proxy domains impersonated America250.org and the Raffles London at The OWO hotel, apparently targeting diplomatic and high-profile visitors, including a possible link to Ukrainian President Zelensky's recent stay.
Technical Details
The script is hosted on infrastructure including static.flux-telemetry[.]com, edge-ord.clouds-stacks[.]com, ad.starx-net[.]com, ads-it-assets[.]com, cdn.adv-static[.]com, wpvortex-mod[.]com, and assets-int[.]com. It collects 394 device/browser fingerprint fields and gates delivery only on basic device-type checks. Three exploit chains were retrieved: Class A (iOS 16.7, cookie theft) chains CVE-2025-43529 (RCE, shared with the DarkSword CSV-linked exploit kit) with CVE-2024-27834 (PAC bypass); dead code for CVE-2024-27808 and CVE-2024-27833 was also found. Class B is a full DarkSword chain combining CVE-2025-43529, CVE-2026-20700 (PAC bypass), CVE-2025-14174 and CVE-2025-43510 (sandbox escape), and CVE-2025-43520 (kernel read/write), exfiltrating SMS, iMessage, Mail, WhatsApp/Telegram databases, Keychain, Wi-Fi PSKs, contacts, Safari cookies, location data, Health data, and photos; alternate exploits CVE-2025-31277 and CVE-2025-24201 exist in the kit but were unused. Class C targets Android Chrome 139–145 (excluding 143) via CVE-2026-3910 (renderer RCE) chained with CVE-2025-27038 (Adreno GPU driver sandbox escape), delivering the AndroSnitch shellcode to steal Chrome cookies, saved passwords, history, and Wi-Fi configs, with similarities to Google's 2024 AndroSnatch report. All exploited vulnerabilities are patched n-days; fully updated devices are not at risk. Attribution to APT29 is supported by victimology (Ukraine/US/Europe focus, far-right political party targeting), infrastructure patterns, overlap with a 2025 APT29 watering hole campaign IOCs, and similarities to a 2024 APT29 Mongolian government watering hole campaign reported by Google TAG using CSV-sourced exploits.
Remediation
Sekoia recommends keeping iOS and Android/Chrome devices fully patched, as none of the exploit chains work against up-to-date devices. Sekoia is coordinating with CERTs of affected countries for victim identification and infrastructure disruption.