APT29 Watering-Hole Campaign Uses N-Day Exploit Chains to Target iOS and Android Visitors
Sekoia disclosed a large-scale watering hole campaign, discovered mid-October 2026, attributed with moderate-to-high confidence to Russia-linked APT29 (SVR Group, Cozy Bear, Nobelium, BlueBravo, Midnight Blizzard, The Dukes). The operation combined hacked websites, cloned/fake sites, and a supply-chain compromise of Ukrainian web analytics provider Plerdy to deliver mobile fingerprinting and exploitation scripts to iOS and Android users. Victims span the US, Ukraine, Czech Republic, Bulgaria and other countries, including a US chemical industry association, a European far-right party, a Bulgarian military-linked site, and a fake hotel website near the UK Ministry of Defence used possibly to target diplomatic visitors including Ukrainian President Zelensky's entourage. All exploit chains relied on patched n-day vulnerabilities, not zero-days, and none persisted on devices.
Detalhes técnicos
Three delivery vectors converged on the same payload: injected JavaScript on compromised sites, fake cloned websites (impersonating America250 and Raffles London at The OWO), and a compromised Plerdy analytics script (a.plerdy[.]com) active between August 27 and September 3, 2026, loaded by thousands of mostly Ukrainian sites. A fingerprinting script dubbed UltimateFingerprinter, hidden in a 2.3MB minified AngularJS file, collected 394 fields via 61 collectors from static[.]flux-telemetry[.]com before deciding whether to serve exploits. Three exploit chains were identified: Class A (iOS 16.7, cookie theft), Class B — linked to the commercial surveillance kit DarkSword (iOS 18.5, full device data including iMessages, WhatsApp/Telegram databases, Keychain, Health data, photos), and Class C (AndroSnitch, Android Chrome 139-145 excluding 143, stealing cookies and Wi-Fi passwords, with a special stop on Samsung Galaxy S25 Ultra devices). AndroSnitch resembles Google TAG's 2024 AndroSnatch. Stolen data was exfiltrated to ad.starx-net[.]com:8881/telemetry/v12. Attribution ties include backend artifacts matching a prior 2025 APT29 watering hole report and framework similarities to a 2024 APT29 campaign against Mongolian government sites (per Google TAG).
Remediação
All exploit chains target known, patched vulnerabilities rather than zero-days; fully updated iOS and Android devices are not vulnerable. Organizations should ensure mobile OS and browser patches are current and monitor for the indicated infrastructure.
Linha do tempo
-
APT29 Watering-Hole Campaign Uses N-Day Exploit Chains to Target iOS and Android Visitors
ler a análise desta fonte ocultar
Sekoia disclosed a large-scale watering hole campaign, discovered mid-October 2026, attributed with moderate-to-high confidence to Russia-linked APT29 (SVR Group, Cozy Bear, Nobelium, BlueBravo, Midnight Blizzard, The Dukes). The operation combined hacked websites, cloned/fake sites, and a supply-chain compromise of Ukrainian web analytics provider Plerdy to deliver mobile fingerprinting and exploitation scripts to iOS and Android users. Victims span the US, Ukraine, Czech Republic, Bulgaria and other countries, including a US chemical industry association, a European far-right party, a Bulgarian military-linked site, and a fake hotel website near the UK Ministry of Defence used possibly to target diplomatic visitors including Ukrainian President Zelensky's entourage. All exploit chains relied on patched n-day vulnerabilities, not zero-days, and none persisted on devices.
Technical Details
Three delivery vectors converged on the same payload: injected JavaScript on compromised sites, fake cloned websites (impersonating America250 and Raffles London at The OWO), and a compromised Plerdy analytics script (a.plerdy[.]com) active between August 27 and September 3, 2026, loaded by thousands of mostly Ukrainian sites. A fingerprinting script dubbed UltimateFingerprinter, hidden in a 2.3MB minified AngularJS file, collected 394 fields via 61 collectors from static[.]flux-telemetry[.]com before deciding whether to serve exploits. Three exploit chains were identified: Class A (iOS 16.7, cookie theft), Class B — linked to the commercial surveillance kit DarkSword (iOS 18.5, full device data including iMessages, WhatsApp/Telegram databases, Keychain, Health data, photos), and Class C (AndroSnitch, Android Chrome 139-145 excluding 143, stealing cookies and Wi-Fi passwords, with a special stop on Samsung Galaxy S25 Ultra devices). AndroSnitch resembles Google TAG's 2024 AndroSnatch. Stolen data was exfiltrated to ad.starx-net[.]com:8881/telemetry/v12. Attribution ties include backend artifacts matching a prior 2025 APT29 watering hole report and framework similarities to a 2024 APT29 campaign against Mongolian government sites (per Google TAG).
Remediation
All exploit chains target known, patched vulnerabilities rather than zero-days; fully updated iOS and Android devices are not vulnerable. Organizations should ensure mobile OS and browser patches are current and monitor for the indicated infrastructure.