APT29 Runs Poisoned Source Watering Hole Campaign with N-Day Mobile Exploits Against iOS and Android
Sekoia's Threat Detection & Research team uncovered a large-scale watering hole campaign, dubbed Poisoned Source, targeting iOS and Android users and linked with moderate to high confidence to APT29 (aka SVR group, Cozy Bear, Nobelium, BlueBravo, Midnight Blizzard, The Dukes), the Russian group tied to the SVR foreign intelligence service. Sekoia first spotted the campaign on the website of a Ukrainian gas production company in mid-October 2026, and traced it to hacked or cloned high-profile websites in the US, Ukraine, the Czech Republic and Bulgaria, plus a one-week supply-chain compromise of the Ukrainian web analytics service Plerdy, which is loaded by thousands of mostly Ukrainian websites. The operators used three infection vectors — direct JavaScript injection on compromised sites, Adversary-in-the-Middle-like lookalike domains, and the Plerdy script compromise — all leading visitors to the same fingerprinting and exploit-delivery infrastructure. The exploit chains rely exclusively on already-patched n-day vulnerabilities, with no zero-days involved, meaning fully updated devices are not at risk. Follow-up reporting (darkreading.com) frames the campaign as evidence that mobile devices have become increasingly attractive intelligence-gathering targets, noting that it potentially reached thousands of iPhone and Android users and that it remains unclear whether the operators pursued specific individuals or indiscriminately compromised as many unpatched devices as possible.
Detalhes técnicos
Compromised or cloned sites included a major US chemical industry trade association, a European far-right political party, a Bulgarian website linked to the military, and two lookalike domains impersonating America250 and Raffles London at The OWO, a hotel near the UK Ministry of Defence and 10 Downing Street where Ukrainian President Volodymyr Zelensky reportedly stayed during an October 14 visit; Sekoia believes the OWO clone may have targeted diplomatic delegations via spear-phishing, though this remains unconfirmed. Between August 27 and September 3, 2026, attackers injected code into the Plerdy tracker (a.plerdy[.]com), exposing visitors of sites tied to the Ukrainian military and defense recruitment. The malicious script, named UltimateFingerprinter by the attackers, runs 61 collectors gathering 394 device/browser fields, padded with a minified AngularJS library making up 98% of a 2.3 MB file, likely to hinder automated/LLM analysis. Only implausible screen sizes or zero touch points block exploit delivery. The delivery server returned three exploit chains (sourced by Sekoia at static.flux-telemetry[.]com): Class A targets iOS 16.7 using CVE-2025-43529 and CVE-2024-27834 to steal cookies; Class B delivers the full DarkSword chain — a suspected commercial-surveillance-vendor iOS exploit kit uploaded to VirusTotal in September 2026 — on iOS 18.5 using CVE-2025-43529, CVE-2026-20700, CVE-2025-14174, CVE-2025-43510 and CVE-2025-43520, exfiltrating messages, iMessage, Mail, voicemail, WhatsApp, Telegram, Keychain, contacts, call history, Safari history/cookies, location, Health data, photos and iCloud Drive; Class C targets Android Chrome 139–145 (excluding 143) using CVE-2026-3910 and CVE-2025-27038, stealing Chrome cookies, logins, history and Wi-Fi passwords via a payload dubbed AndroSnitch, which stops execution on the Samsung Galaxy S25 Ultra and resembles a 2024 Google TAG-documented payload. None of the chains establish persistence, and all exfiltrated data is sent to ad.starx-net[.]com:8881/telemetry/v12. Attribution to APT29 rests on forensic overlaps with a 2025 watering hole campaign reported by a partner CERT, similarities to a 2024 APT29 campaign against Mongolian government sites identified by Google TAG, victimology skewed to Europe/Ukraine/US, multi-hoster infrastructure, and the targeting of a Czech far-right political party consistent with APT29's history of targeting European political parties. Analysis published alongside the campaign (darkreading.com) further notes that APT29's apparent sourcing of the DarkSword exploit kit from a third-party, suspected commercial-surveillance provider suggests that sophisticated mobile intrusion capabilities once largely associated with highly targeted espionage are now finding their way into broader campaigns, as commercial spyware vendors increasingly make large-scale mobile surveillance technology available.
Remediação
Sekoia states that every exploited flaw was already patched by its vendor (Apple or Google) before the campaign began, and that none of the three chains work against fully updated devices; organizations should ensure iOS, iPadOS and Android/Chrome installations are fully patched to eliminate exposure to these n-day exploit chains.
Linha do tempo
-
APT29 Mobile Watering Hole Campaign Hits Thousands via Compromised Plerdy Analytics
DarkReading's follow-up coverage adds no new technical indicators or victims, but frames the campaign as evidence that mobile devices have become increasingly attractive intelligence targets, and notes that APT29's apparent sourcing of the DarkSword exploit kit from a commercial-surveillance vendor shows how sophisticated mobile intrusion capabilities, once reserved for highly targeted espionage, are proliferating into broader campaigns.
ler a análise desta fonte ocultar
DarkReading's follow-up coverage adds no new technical indicators or victims, but frames the campaign as evidence that mobile devices have become increasingly attractive intelligence targets, and notes that APT29's apparent sourcing of the DarkSword exploit kit from a commercial-surveillance vendor shows how sophisticated mobile intrusion capabilities, once reserved for highly targeted espionage, are proliferating into broader campaigns.
APT29 (the Russian SVR-linked group also known as Cozy Bear, Midnight Blizzard, Nobelium or The Dukes) compromised websites and a web analytics service to run large-scale watering hole attacks fingerprinting and exploiting mobile users, according to Sekoia. The campaign briefly hijacked a Ukrainian SEO and analytics provider to distribute malicious device-fingerprinting code to potentially thousands of iPhone and Android users. Compromised sites included a US chemical-industry trade association, a Ukrainian gas producer, and a Bulgarian military-related organization, with Sekoia noting that thousands of mostly Ukrainian websites load the analytics provider's tracking scripts. Attribution to APT29 rests on forensic overlaps with a separate 2025 watering-hole operation previously linked to the group, though it remains unclear whether the campaign pursued specific individuals or broader indiscriminate mobile device compromise.
Technical Details
APT29 used three separate infection vectors to target iOS and Android devices in the campaign. The group's apparent sourcing of the DarkSword exploit kit from a third-party, suspected commercial-surveillance vendor suggests that sophisticated mobile intrusion capabilities once reserved for highly targeted espionage are increasingly being folded into broader campaigns, a trend the article frames as part of a wider pattern of commercial spyware vendors enabling large-scale mobile surveillance and data theft.
Remediation
Keeping iOS, iPadOS and Android/Chrome devices fully patched eliminates exposure, since the campaign relies exclusively on already-patched n-day vulnerabilities rather than zero-days.
-
APT29 Runs Poisoned Source Watering Hole Campaign with N-Day Mobile Exploits Against iOS and Android
ler a análise desta fonte ocultar
Sekoia's Threat Detection & Research team uncovered a large-scale watering hole campaign, dubbed Poisoned Source, targeting iOS and Android users and linked with moderate to high confidence to APT29 (aka SVR group, Cozy Bear, Nobelium, BlueBravo, Midnight Blizzard, The Dukes), the Russian group tied to the SVR foreign intelligence service. Sekoia first spotted the campaign on the website of a Ukrainian gas production company in mid-October 2026, and traced it to hacked or cloned high-profile websites in the US, Ukraine, the Czech Republic and Bulgaria, plus a one-week supply-chain compromise of the Ukrainian web analytics service Plerdy, which is loaded by thousands of mostly Ukrainian websites. The operators used three infection vectors — direct JavaScript injection on compromised sites, Adversary-in-the-Middle-like lookalike domains, and the Plerdy script compromise — all leading visitors to the same fingerprinting and exploit-delivery infrastructure. The exploit chains rely exclusively on already-patched n-day vulnerabilities, with no zero-days involved, meaning fully updated devices are not at risk.
Technical Details
Compromised or cloned sites included a major US chemical industry trade association, a European far-right political party, a Bulgarian website linked to the military, and two lookalike domains impersonating America250 and Raffles London at The OWO, a hotel near the UK Ministry of Defence and 10 Downing Street where Ukrainian President Volodymyr Zelensky reportedly stayed during an October 14 visit; Sekoia believes the OWO clone may have targeted diplomatic delegations via spear-phishing, though this remains unconfirmed. Between August 27 and September 3, 2026, attackers injected code into the Plerdy tracker (a.plerdy[.]com), exposing visitors of sites tied to the Ukrainian military and defense recruitment. The malicious script, named UltimateFingerprinter by the attackers, runs 61 collectors gathering 394 device/browser fields, padded with a minified AngularJS library making up 98% of a 2.3 MB file, likely to hinder automated/LLM analysis. Only implausible screen sizes or zero touch points block exploit delivery. The delivery server returned three exploit chains (sourced by Sekoia at
static.flux-telemetry[.]com): Class A targets iOS 16.7 using CVE-2025-43529 and CVE-2024-27834 to steal cookies; Class B delivers the full DarkSword chain — a suspected commercial-surveillance-vendor iOS exploit kit uploaded to VirusTotal in September 2026 — on iOS 18.5 using CVE-2025-43529, CVE-2026-20700, CVE-2025-14174, CVE-2025-43510 and CVE-2025-43520, exfiltrating messages, iMessage, Mail, voicemail, WhatsApp, Telegram, Keychain, contacts, call history, Safari history/cookies, location, Health data, photos and iCloud Drive; Class C targets Android Chrome 139–145 (excluding 143) using CVE-2026-3910 and CVE-2025-27038, stealing Chrome cookies, logins, history and Wi-Fi passwords via a payload dubbed AndroSnitch, which stops execution on the Samsung Galaxy S25 Ultra and resembles a 2024 Google TAG-documented payload. None of the chains establish persistence, and all exfiltrated data is sent toad.starx-net[.]com:8881/telemetry/v12. Attribution to APT29 rests on forensic overlaps with a 2025 watering hole campaign reported by a partner CERT, similarities to a 2024 APT29 campaign against Mongolian government sites identified by Google TAG, victimology skewed to Europe/Ukraine/US, multi-hoster infrastructure, and the targeting of a Czech far-right political party consistent with APT29's history of targeting European political parties.Remediation
Sekoia states that every exploited flaw was already patched by its vendor (Apple or Google) before the campaign began, and that none of the three chains work against fully updated devices; organizations should ensure iOS, iPadOS and Android/Chrome installations are fully patched to eliminate exposure to these n-day exploit chains.