APT29 Runs Watering Hole Campaign Using N-Day iOS/Android Exploit Chains and Plerdy Supply-Chain Compromise
Sekoia disclosed a large-scale watering hole campaign, discovered mid-October 2026, attributed with moderate-to-high confidence to APT29 (Midnight Blizzard, Cozy Bear, The Dukes), linked to Russia's SVR. The campaign compromised or cloned high-profile websites in the US, Ukraine, Czech Republic, and Bulgaria, and included a one-week supply-chain compromise (27 August–3 September 2026) of the Ukrainian web analytics service Plerdy, exposing thousands of sites, mostly Ukrainian military/defense-related, to the exploit kit. Three infection vectors (direct JS injection, AiTM-like lookalike domains, and the Plerdy supply-chain compromise) deliver a fingerprinting script, UltimateFingerprinter, that profiles visitor devices and serves platform-specific n-day exploit chains without user interaction, exfiltrating iOS cookies/full device data or Android Chrome data and Wi-Fi passwords. Notable AiTM proxy domains impersonated America250.org and the Raffles London at The OWO hotel, apparently targeting diplomatic and high-profile visitors, including a possible link to Ukrainian President Zelensky's recent stay.
Entenda a falha
A vulnerabilidade
Twelve CVEs are used in n-day exploit chains served by a watering hole kit, with no user interaction beyond visiting a page. On iOS (16.0-17.4 per the story; the Class A chain targets iOS 16.7) the chains combine RCE CVE-2025-43529 with PAC bypasses CVE-2024-27834 and CVE-2026-20700, sandbox escapes CVE-2025-14174 and CVE-2025-43510, and kernel read/write CVE-2025-43520. CVE-2024-27808, CVE-2024-27833, CVE-2025-31277 and CVE-2025-24201 were present but unused or dead code. On Android, Chrome 139-145 (excluding 143) is hit by renderer RCE CVE-2026-3910 chained with Adreno GPU driver sandbox escape CVE-2025-27038. The attacker only needs the victim to browse a compromised or cloned site. The outcome is theft of cookies, messages, Keychain, passwords and Wi-Fi credentials. All are patched; fully updated devices are not at risk.
Como funciona
A visitor opens a legitimate site that was modified (injected script, a tampered JavaScript file, the compromised Plerdy tracker main.js) or a lookalike reverse-proxy domain that patches the HTML on the fly. Once the page finishes loading, a small script pulls in an external file, UltimateFingerprinter, which collects 394 device and browser fields. The delivery server checks basically the device type and browser or OS version, then serves the matching exploit chain. The chain gains code execution in the browser, bypasses pointer authentication on iOS, escapes the sandbox and, on iOS, reaches kernel read/write. The final payload exfiltrates data and does not establish persistence.
Por que é vulnerável
The articles do not describe the root cause of each CVE. What they establish is that every flaw is an already patched n-day, so the exposure comes from devices that have not applied iOS, Chrome or Android updates. The chains rely on layered weaknesses: code execution, then PAC bypass, sandbox escape and kernel access. Separately, the delivery relied on web content being trusted: a third-party tracker script on a.plerdy[.]com was altered for one week, and how it was compromised is not stated in the material provided.
Como foi descoberta
Sekoia's Threat Detection & Research team found the campaign in mid-October 2026, starting from a malicious JavaScript inclusion on the website of a Ukrainian gas production company. Further analysis revealed other compromised sites, lookalike proxy domains, and requests coming from many sites sharing the Plerdy SEO Tracker. Sekoia notes that DarkSword, one of the chains, is a suspected commercial surveillance vendor iOS kit uploaded to VirusTotal in September 2026. Sekoia published its report on 29 October 2026 and says it is coordinating with CERTs of affected countries on victim identification and infrastructure disruption.
PoC existente, privada
O exploit existe, mas quem o tem não o publicou.
Working exploit chains exist and were used in real attacks: Sekoia retrieved three (iOS Class A cookie theft, the full DarkSword iOS chain, and an Android Chrome chain delivering the AndroSnitch shellcode). The articles do not point to a published repository or write-up with a working demonstration, only the DarkSword kit uploaded to VirusTotal, so access is treated as private. Because the chains are weaponized and active against unpatched iOS and Chrome/Android devices, updating is urgent for exposed users.
Explicação gerada por IA a partir da matéria e dos artigos, em 04/11/2026 03:17.
Detalhes técnicos
The script is hosted on infrastructure including static.flux-telemetry[.]com, edge-ord.clouds-stacks[.]com, ad.starx-net[.]com, ads-it-assets[.]com, cdn.adv-static[.]com, wpvortex-mod[.]com, and assets-int[.]com. It collects 394 device/browser fingerprint fields and gates delivery only on basic device-type checks. Three exploit chains were retrieved: Class A (iOS 16.7, cookie theft) chains CVE-2025-43529 (RCE, shared with the DarkSword CSV-linked exploit kit) with CVE-2024-27834 (PAC bypass); dead code for CVE-2024-27808 and CVE-2024-27833 was also found. Class B is a full DarkSword chain combining CVE-2025-43529, CVE-2026-20700 (PAC bypass), CVE-2025-14174 and CVE-2025-43510 (sandbox escape), and CVE-2025-43520 (kernel read/write), exfiltrating SMS, iMessage, Mail, WhatsApp/Telegram databases, Keychain, Wi-Fi PSKs, contacts, Safari cookies, location data, Health data, and photos; alternate exploits CVE-2025-31277 and CVE-2025-24201 exist in the kit but were unused. Class C targets Android Chrome 139–145 (excluding 143) via CVE-2026-3910 (renderer RCE) chained with CVE-2025-27038 (Adreno GPU driver sandbox escape), delivering the AndroSnitch shellcode to steal Chrome cookies, saved passwords, history, and Wi-Fi configs, with similarities to Google's 2024 AndroSnatch report. All exploited vulnerabilities are patched n-days; fully updated devices are not at risk. Attribution to APT29 is supported by victimology (Ukraine/US/Europe focus, far-right political party targeting), infrastructure patterns, overlap with a 2025 APT29 watering hole campaign IOCs, and similarities to a 2024 APT29 Mongolian government watering hole campaign reported by Google TAG using CSV-sourced exploits.
Remediação
Sekoia recommends keeping iOS and Android/Chrome devices fully patched, as none of the exploit chains work against up-to-date devices. Sekoia is coordinating with CERTs of affected countries for victim identification and infrastructure disruption.
Linha do tempo
-
APT29 Runs Watering Hole Campaign Using N-Day iOS/Android Exploit Chains and Plerdy Supply-Chain Compromise
ler a análise desta fonte ocultar
Sekoia disclosed a large-scale watering hole campaign, discovered mid-October 2026, attributed with moderate-to-high confidence to APT29 (Midnight Blizzard, Cozy Bear, The Dukes), linked to Russia's SVR. The campaign compromised or cloned high-profile websites in the US, Ukraine, Czech Republic, and Bulgaria, and included a one-week supply-chain compromise (27 August–3 September 2026) of the Ukrainian web analytics service Plerdy, exposing thousands of sites, mostly Ukrainian military/defense-related, to the exploit kit. Three infection vectors (direct JS injection, AiTM-like lookalike domains, and the Plerdy supply-chain compromise) deliver a fingerprinting script, UltimateFingerprinter, that profiles visitor devices and serves platform-specific n-day exploit chains without user interaction, exfiltrating iOS cookies/full device data or Android Chrome data and Wi-Fi passwords. Notable AiTM proxy domains impersonated America250.org and the Raffles London at The OWO hotel, apparently targeting diplomatic and high-profile visitors, including a possible link to Ukrainian President Zelensky's recent stay.
Technical Details
The script is hosted on infrastructure including static.flux-telemetry[.]com, edge-ord.clouds-stacks[.]com, ad.starx-net[.]com, ads-it-assets[.]com, cdn.adv-static[.]com, wpvortex-mod[.]com, and assets-int[.]com. It collects 394 device/browser fingerprint fields and gates delivery only on basic device-type checks. Three exploit chains were retrieved: Class A (iOS 16.7, cookie theft) chains CVE-2025-43529 (RCE, shared with the DarkSword CSV-linked exploit kit) with CVE-2024-27834 (PAC bypass); dead code for CVE-2024-27808 and CVE-2024-27833 was also found. Class B is a full DarkSword chain combining CVE-2025-43529, CVE-2026-20700 (PAC bypass), CVE-2025-14174 and CVE-2025-43510 (sandbox escape), and CVE-2025-43520 (kernel read/write), exfiltrating SMS, iMessage, Mail, WhatsApp/Telegram databases, Keychain, Wi-Fi PSKs, contacts, Safari cookies, location data, Health data, and photos; alternate exploits CVE-2025-31277 and CVE-2025-24201 exist in the kit but were unused. Class C targets Android Chrome 139–145 (excluding 143) via CVE-2026-3910 (renderer RCE) chained with CVE-2025-27038 (Adreno GPU driver sandbox escape), delivering the AndroSnitch shellcode to steal Chrome cookies, saved passwords, history, and Wi-Fi configs, with similarities to Google's 2024 AndroSnatch report. All exploited vulnerabilities are patched n-days; fully updated devices are not at risk. Attribution to APT29 is supported by victimology (Ukraine/US/Europe focus, far-right political party targeting), infrastructure patterns, overlap with a 2025 APT29 watering hole campaign IOCs, and similarities to a 2024 APT29 Mongolian government watering hole campaign reported by Google TAG using CSV-sourced exploits.
Remediation
Sekoia recommends keeping iOS and Android/Chrome devices fully patched, as none of the exploit chains work against up-to-date devices. Sekoia is coordinating with CERTs of affected countries for victim identification and infrastructure disruption.