APT29 Watering Hole Campaign "Poisoned Source" Delivers N-Day Mobile Exploits; CISA Adds Apple PAC Bypass to KEV, While Related Coruna/DarkSword Kits Spread via Leaked Frameworks and Expired-Domain Abuse

Linha do tempo

1. thehackernews.com ↗ · pub. 05/11/2026 02:17 · coletado 05/11 04:00

   CISA Adds Apple Pointer Authentication Bypass CVE-2024-27834 to KEV Catalog Over APT29 Exploitation

   CISA has formally added CVE-2024-27834, the Apple Pointer Authentication bypass used in the APT29 "Poisoned Source" exploit chain, to its Known Exploited Vulnerabilities catalog, citing confirmed active exploitation and setting a November 18, 2026 remediation deadline for U.S. federal civilian agencies, providing the first official government confirmation that the n-day flaw documented by Sekoia is being actively weaponized in the wild.

   ler a análise desta fonte ocultar

   CISA has formally added CVE-2024-27834, the Apple Pointer Authentication bypass used in the APT29 "Poisoned Source" exploit chain, to its Known Exploited Vulnerabilities catalog, citing confirmed active exploitation and setting a November 18, 2026 remediation deadline for U.S. federal civilian agencies, providing the first official government confirmation that the n-day flaw documented by Sekoia is being actively weaponized in the wild.

   The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2024-27834 to its Known Exploited Vulnerabilities (KEV) catalog after reports of active exploitation. The vulnerability is a case of improper authentication that could allow an attacker with arbitrary read and write capability to bypass Pointer Authentication, carrying a CVSS score of 5.5. Apple addressed it in May 2024 with improved checks in iOS 16.7.8 and iPadOS 16.7.8, iOS 17.5 and iPadOS 17.5, macOS Sonoma 14.5, tvOS 17.5, watchOS 10.5, and Safari 17.5, and the flaw was demonstrated as a zero-day at the Pwn2Own Vancouver hacking contest held in March 2024. The KEV listing follows a Sekoia report describing APT29 (Cozy Bear, Midnight Blizzard) abuse of this and other previously patched Safari and Chrome vulnerabilities to deliver information-stealing malware via watering-hole sites and a supply-chain compromise of the Plerdy SEO Tracker.

   Technical Details

   The attacks involve three initial access pathways – compromised legitimate websites, fake sites masquerading as popular websites, and a supply chain attack aimed at Plerdy SEO Tracker – to serve malicious JavaScript that triggers the vulnerability and ultimately deploy the information-stealing payload after profiling the visitor's device. The zero-click exploit chain combines a remote code execution flaw in WebKit (CVE-2025-43529) with the pointer authentication codes (PACs) bypass to execute a JavaScript payload designed for browser cookie theft. The activity has been attributed to APT29, a state-sponsored hacking group affiliated with Russia's Foreign Intelligence Service, with "moderate to high confidence."

   Remediation

   In light of active exploitation, Federal Civilian Executive Branch (FCEB) agencies are recommended to apply the necessary patches by November 18, 2026. Organizations running fully updated iOS, iPadOS, macOS, tvOS, watchOS and Safari releases are not affected, since the flaw was already fixed by Apple in May 2024.

2. helpnetsecurity.com ↗ · pub. 04/11/2026 11:38 · coletado 04/11 12:01

   APT29 Watering Hole Campaign Uses N-Day iOS/Android Exploits via Compromised Sites, Lookalike Domains and Plerdy Supply-Chain Hack

   This article adds that an Australian medical clinic site, with no obvious strategic value, was likely used to target specific individuals, and cites open-source reporting that Ukrainian President Volodymyr Zelensky stayed at the real Raffles London at The OWO hotel on 14 October 2026, the site cloned by the attackers. It also notes that earlier in the summer, Microsoft separately reported the same APT29/Midnight Blizzard group had spent months hijacking hotel and conference center Wi-Fi networks to steal Microsoft 365 credentials and deliver malware, and that Sekoia frames the campaign as part of a broader trend of state-sponsored actors reusing commercial-surveillance-vendor (CSV) mobile exploit frameworks like DarkSword to lower the cost of advanced mobile exploitation.

   ler a análise desta fonte ocultar

   This article adds that an Australian medical clinic site, with no obvious strategic value, was likely used to target specific individuals, and cites open-source reporting that Ukrainian President Volodymyr Zelensky stayed at the real Raffles London at The OWO hotel on 14 October 2026, the site cloned by the attackers. It also notes that earlier in the summer, Microsoft separately reported the same APT29/Midnight Blizzard group had spent months hijacking hotel and conference center Wi-Fi networks to steal Microsoft 365 credentials and deliver malware, and that Sekoia frames the campaign as part of a broader trend of state-sponsored actors reusing commercial-surveillance-vendor (CSV) mobile exploit frameworks like DarkSword to lower the cost of advanced mobile exploitation.

   Sekoia's Threat Detection & Research (TDR) team reports that Russia's APT29 (also known as Midnight Blizzard or Cozy Bear, tied to the SVR) has been running a watering hole campaign, spotted in mid-October 2026, that combines compromised websites, lookalike domains and a hijacked Ukrainian web analytics service (Plerdy) to serve n-day exploit chains to iOS and Android visitors without user interaction. The campaign targets a mix of strategic sites, including a Ukrainian gas producer, a US chemical industry trade association, a far-right European political party, a Bulgarian military-related organization, and lookalike pages impersonating America250 and Raffles London at The OWO hotel near the UK Ministry of Defence. Three exploit chains are used: one chaining CVE-2025-43529 and CVE-2024-27834 against iOS 16.7 to steal cookies; the DarkSword kit chain (CVE-2025-43529, CVE-2026-20700, CVE-2025-14174, CVE-2025-43510, CVE-2025-43520) against iOS 18.5 to exfiltrate messages, Keychain passwords, location, health data and photos; and a Chrome/Android chain (CVE-2026-3910, CVE-2025-27038) stealing cookies, saved logins, history and Wi-Fi passwords. All exploited flaws were already patched before the campaign, and the payloads do not persist on devices.

   Technical Details

   Researchers note that the attackers used compromised websites, lookalike domains and a hijacked web analytics service to target iOS and Android users with exploits for patched flaws and steal their cookies, messages and Wi-Fi passwords. The campaign relies on three infection vectors: direct JavaScript injection on legitimate websites, Adversary-in-the-Middle-like domains, and the supply-chain compromise of the Ukrainian web analytics service, all delivering the same payload, a code injection that loads an external script to profile the visitor's browser and device, with the delivery host then serving platform-specific n-day exploit chains without user interaction. Beyond the previously reported targets, researchers found the site of an Australian medical clinic had no obvious strategic value, and the TDR team believes, with low confidence, that it may have been used to go after specific individuals. Regarding the Raffles London at The OWO lookalike, researchers mention open-source reporting that Ukrainian President Volodymyr Zelensky stayed there during a visit on 14 October. The attribution to APT29 is reinforced by traces of a 2025 APT29 watering hole operation found on one of the compromised sites, similarities with a 2024 APT29 campaign against Mongolian government websites that Google's Threat Analysis Group confirmed, and a victim list centered on Ukraine. Sekoia also places the campaign in a broader trend, assessing that the campaign confirms the continued reuse of CSV mobile exploit frameworks, such as DarkSword, by state-sponsored intrusion sets, and that the adoption of packaged n-day exploit chains lowers the cost and technical threshold required to conduct advanced mobile exploitation.

   Remediation

   Every flaw in the three chains had been fixed before the campaign began, and Sekoia stressed that a user running an up-to-date operating system is safe from these attacks. Sekoia said it is working with the CERTs of the affected countries, CERT-UA among them, to identify victims and look for ways to disrupt the watering hole infrastructure.

3. infosecurity-magazine.com ↗ · pub. 04/11/2026 11:00 · coletado 04/11 12:01

   APT29 Watering Hole Campaign Serves N-Day iPhone and Android Exploit Chains to Site Visitors

   The article corroborates Sekoia's Poisoned Source findings and adds that, besides the previously reported Ukrainian gas producer and Bulgarian military-related site, the campaign also compromised Ukrainian military and military-equipment websites, broadening the known list of targeted legitimate sites in Ukraine.

   ler a análise desta fonte ocultar

   The article corroborates Sekoia's Poisoned Source findings and adds that, besides the previously reported Ukrainian gas producer and Bulgarian military-related site, the campaign also compromised Ukrainian military and military-equipment websites, broadening the known list of targeted legitimate sites in Ukraine.

   A cyberespionage campaign attributed with moderate-to-high confidence to Russia's APT29 (also tracked as Midnight Blizzard and Cozy Bear) served exploit chains for already-patched iOS and Android flaws to visitors of legitimate websites, deploying payloads that steal cookies, device data and Wi-Fi passwords without requiring any user interaction. Sekoia uncovered the activity in mid-October 2026 and published its research on November 4. The operation used three delivery routes: direct script injection into legitimate sites, lookalike domains proxying real sites (impersonating the America250 initiative and a London hotel), and a week-long supply-chain compromise of Plerdy, a Ukrainian website analytics tracker loaded by thousands of mostly Ukrainian sites. Compromised legitimate sites included a Ukrainian gas producer, Ukrainian military and military-equipment sites, a US chemical-industry trade association, a Czech far-right movement and a Bulgarian military-related site.

   Technical Details

   The Plerdy compromise ran from August 27 to September 3, 2026, exposing hundreds of sites and their visitors to the exploit kit; Sekoia did not disclose how many devices were compromised. Visitors were fingerprinted and served exploit chains matched to their device, and none of the payloads established persistence. One chain targeted iOS 16.7 to steal cookies; a second, based on the DarkSword exploit kit (suspected to be developed by a commercial surveillance vendor), targeted iOS 18.5 to collect full device data; a third targeted Chrome 139-145 on Android (excluding version 143) to steal browser cookies and Wi-Fi passwords. All exploits relied on n-day vulnerabilities already disclosed and patched: CVE-2025-43529, CVE-2024-27834, CVE-2026-20700, CVE-2025-14174, CVE-2025-43510, CVE-2025-43520, CVE-2026-3910 and CVE-2025-27038. Sekoia's analysis supports the idea that APT29 obtained the exploits from a third party rather than developing them in-house. The campaign cast a wider net than a 2024 APT29 operation against Mongolian government sites, which used a hardcoded filter to target specific websites, as this campaign had no such filter and collected any cookies present in the browser.

   Remediation

   Because every exploit chain relies on already-patched n-day flaws, users running fully updated iOS and Android/Chrome versions are not affected; in Sekoia's words, a user running an up-to-date operating system is safe from these attacks. Keeping mobile operating systems and browsers current remains the primary mitigation.

4. thehackernews.com ↗ · pub. 04/11/2026 11:27 · coletado 04/11 12:00

   APT29-Linked "Poisoned Source" Campaign Hijacks Plerdy Analytics Script to Deliver iOS/Android N-Day Exploits

   This article adds the campaign's codename "Poisoned Source" and credits Sekoia researchers Amaury-Jacques Garçon and Félix Aime, while also reporting on the parallel evolution of the Coruna and DarkSword exploit kits documented separately by iVerify, Report URI, and Zimperium zLabs: a DarkSword P7 variant spread via malicious Instagram ads, a criminal "DeadTag" campaign using over 660 expired/re-registered domains to redirect iPhone visitors to Coruna (iOS 13-17.2.1) or DarkSword P7 (iOS 18.4-18.7), and Zimperium's count of 608 domains currently delivering Coruna-family code, underscoring that the originally nation-state Coruna toolkit has leaked and is now used broadly by multiple threat actors beyond APT29.

   ler a análise desta fonte ocultar

   This article adds the campaign's codename "Poisoned Source" and credits Sekoia researchers Amaury-Jacques Garçon and Félix Aime, while also reporting on the parallel evolution of the Coruna and DarkSword exploit kits documented separately by iVerify, Report URI, and Zimperium zLabs: a DarkSword P7 variant spread via malicious Instagram ads, a criminal "DeadTag" campaign using over 660 expired/re-registered domains to redirect iPhone visitors to Coruna (iOS 13-17.2.1) or DarkSword P7 (iOS 18.4-18.7), and Zimperium's count of 608 domains currently delivering Coruna-family code, underscoring that the originally nation-state Coruna toolkit has leaked and is now used broadly by multiple threat actors beyond APT29.

   Sekoia researchers Amaury-Jacques Garçon and Félix Aime detailed a large-scale watering hole campaign, codenamed Poisoned Source and discovered in mid-October 2026, attributed to the Russia-linked APT29. The operation targets iOS and Android users through compromised legitimate websites, lookalike domains impersonating high-profile sites in the U.S., Ukraine, Czech Republic and Bulgaria, and a supply-chain compromise of the Ukrainian web analytics service Plerdy SEO Tracker between 27 August and 3 September 2026. All three vectors load a fingerprinting JavaScript loader that profiles the visitor's device and browser before delivering a platform-specific N-day exploit chain, with the goal of stealing browser cookies, Wi-Fi passwords, or full mobile device data without establishing persistence.

   Technical Details

   Some of the compromised websites include a major industry trade association representing U.S. companies operating in the chemical industry, a far-right European political party, and a Bulgarian military-related website, and several of these sites are likely to attract high-value or strategically important visitors in the context of the Russia-Ukraine war, spreading through army, special forces, and military equipment websites. Three exploit classes were identified: Class A targets iOS devices running iOS 16.7 and exploits CVE-2025-43529 and CVE-2024-27834 to deliver JavaScript malware for cookie theft. Class B targets iOS devices running iOS 18.5 and exploits the DarkSword exploit chain comprising CVE-2025-43529, CVE-2026-20700, CVE-2025-14174, CVE-2025-43510, and CVE-2025-43520 to exfiltrate SMS/iMessages, Mail databases, voicemail, WhatsApp/Telegram data, iCloud Keychain, Wi-Fi passwords, contacts, call history, Safari history/cookies, photos and Health/Calendar/Notes/iCloud Drive data. Class C targets Android devices running Chrome versions from 139 through 145 (excluding version 143) and exploits CVE-2026-3910 and CVE-2025-27038 to achieve remote code execution, sandbox escape, privilege escalation, and deliver AndroSnitch to collect Chrome data and Wi-Fi passwords. Exfiltrated data is sent to the ad.starx-net[.]com:8881/telemetry/v12 endpoint, and the Android chain checks whether the targeted device is a Samsung Galaxy S25 Ultra (SM-S938B), terminating exploitation if it matches. AndroSnitch derives its name from its similarities to ANDROSNATCH, a Chrome cookie-stealing payload Google documented in August 2024 in a suspected APT29 watering hole campaign against a Mongolian government website, using CVE-2024-5274 and CVE-2024-4671, and Sekoia noted continued reuse of CSV mobile exploit frameworks such as DarkSword by state-sponsored intrusion sets.

   Separately, iVerify and Report URI detailed the evolution of the Coruna and DarkSword exploit kits. A P7 variant of DarkSword is being delivered via half-click attacks leveraging ad-based infrastructure, in one case propagated through a malicious Instagram ad themed around the World Cup and served from ad-track[.]live. A separate criminal campaign dubbed DeadTag has attackers acquiring expired domains behind old analytics and advertising tags still loaded by thousands of websites to serve malicious JavaScript to iPhone visitors silently. The DeadTag paths lead to the Coruna exploit kit for iPhones running iOS 13 to 17.2.1 and DarkSword P7 for devices running iOS 18.4 to 18.7, and more than 660 expired and re-registered domains are part of the DeadTag network. According to Zimperium zLabs, campaigns distributing Coruna and DarkSword exploit kits have continued to evolve, with 608 domains delivering Coruna-family code as of October 2026, and Coruna was initially developed by a nation-state actor for highly targeted operations before leaking and becoming widely accessible to multiple threat actors. Researcher Santiago Rodriguez noted that targets running iOS 17.2.1 or earlier receive the legacy Coruna framework, while devices running later iOS builds receive a DarkSword-derived execution chain, with the distribution footprint spanning dating portals, AI-companion platforms, cryptocurrency promotions, media streaming services, and compromised legitimate sites serving the kit via hidden iframes.

   Remediation

   All exploited vulnerabilities are already patched n-days; keeping iOS, Android and Chrome fully updated prevents exploitation, and because no persistence mechanism is used, rebooting an affected device halts the malicious activity until the device revisits a malicious site. Users should avoid opening links in Safari/system browsers from untrusted ad networks, exit in-app browsers only when the destination is trusted, and organizations should review any dependency on the Plerdy tracker and monitor for connections to ad.starx-net[.]com.

5. gbhackers.com ↗ · pub. 04/11/2026 09:45 · coletado 04/11 10:00

   APT29-Linked Watering Hole Campaign Abuses Compromised Sites and Plerdy Supply-Chain Hack to Deliver iOS and Android N-Day Exploits

   This article adds that Google's Threat Analysis Group, in a March 2026 report, described the DarkSword iOS exploit kit used in Chain B as supporting iOS 18.4-18.7 with six vulnerabilities (several exploited as zero-days), noting it has been adopted by commercial surveillance vendors and suspected state actors, and that Google linked related watering-hole activity on Ukrainian sites to UNC6353, a suspected Russian espionage cluster, which strengthens the Russian state-sponsored attribution. It also notes Apple patched all DarkSword flaws by iOS 26.3, that the 2024 APT29-linked Mongolia campaign used n-day exploits comparable to those of commercial surveillance vendors NSO Group and Intellexa, and that the targeting of a Czech political party site mirrors a pattern Mandiant documented in a 2024 WINELOADER phishing campaign against German political parties.

   ler a análise desta fonte ocultar

   This article adds that Google's Threat Analysis Group, in a March 2026 report, described the DarkSword iOS exploit kit used in Chain B as supporting iOS 18.4-18.7 with six vulnerabilities (several exploited as zero-days), noting it has been adopted by commercial surveillance vendors and suspected state actors, and that Google linked related watering-hole activity on Ukrainian sites to UNC6353, a suspected Russian espionage cluster, which strengthens the Russian state-sponsored attribution. It also notes Apple patched all DarkSword flaws by iOS 26.3, that the 2024 APT29-linked Mongolia campaign used n-day exploits comparable to those of commercial surveillance vendors NSO Group and Intellexa, and that the targeting of a Czech political party site mirrors a pattern Mandiant documented in a 2024 WINELOADER phishing campaign against German political parties.

   A watering hole operation attributed with moderate-to-high confidence to APT29 (Midnight Blizzard, Cozy Bear, The Dukes) combined direct JavaScript injection on legitimate sites, lookalike adversary-in-the-middle proxy domains (america250[.]holiday, theowo[.]club), and a supply-chain compromise of Ukraine's Plerdy SEO Tracker between 27 August and 3 September 2026 to profile and exploit mobile visitors. All three vectors loaded a fingerprinting script dubbed UltimateFingerprinter, hidden inside roughly 2.3 MB of dead AngularJS code, which collected 394 data fields via 61 collectors before the attacker server decided, based on basic device-plausibility checks, whether to serve an exploit. Three exploit chains were used, each relying solely on already-patched n-day vulnerabilities rather than zero-days, so fully updated devices are not exposed. Google's Threat Analysis Group separately documented the DarkSword iOS kit used in Chain B and linked related watering-hole activity on Ukrainian sites to UNC6353, a suspected Russian espionage cluster, strengthening the case for Russian state involvement.

   Technical Details

   Chain A targets iOS 16.7 using CVE-2025-43529 and CVE-2024-27834 to steal cookies. Chain B is the full DarkSword kit targeting iOS 18.5, adding CVE-2026-20700, CVE-2025-14174, CVE-2025-43510 and CVE-2025-43520 to harvest messages, WhatsApp and Telegram databases, Keychain secrets, Wi-Fi passwords, location caches, photos and iCloud Drive content. Chain C targets Android Chrome 139-145 (excluding 143) via CVE-2026-3910 and the Adreno GPU driver flaw CVE-2025-27038, deploying a payload dubbed AndroSnitch that exfiltrates Chrome cookies, saved logins, history and Wi-Fi configuration. All chains exfiltrate to ad.starx-net[.]com:8881/telemetry/v12 and establish no persistence. Google's threat intelligence group described DarkSword in March 2026 as an iOS chain supporting iOS 18.4–18.7, using six vulnerabilities, several of which were exploited as zero-days, and it has been adopted by commercial surveillance vendors and suspected state actors, with Google noting that UNC6353, a suspected Russian espionage cluster, had added it to watering hole attacks on Ukrainian sites. Apple patched all DarkSword flaws by iOS 26.3. Sekoia's attribution rests partly on a compromised site whose files matched a private report on a 2025 APT29 watering hole, and on Google TAG confirming the framework resembles APT29's 2024 campaign against Mongolian government sites, which used n-day exploits comparable to NSO Group and Intellexa tooling but only targeted a hard-coded list of webmail and login sites, unlike the current campaign which collects any cookie. A compromised far-right Czech party site also matches APT29's history of targeting European political parties, a pattern Mandiant documented in a 2024 WINELOADER phishing campaign against German parties.

   Remediation

   Defenders should patch iOS and Chrome and block the indicated domains, with Google recommending Lockdown Mode where updates are not possible. Network teams should hunt for the starx-net, flux-telemetry and clouds-stacks domains and review any use of the Plerdy tracker. Sekoia is working with affected countries' CERTs on victim identification and possible infrastructure disruption.

6. bleepingcomputer.com ↗ · pub. 04/11/2026 06:39 · coletado 04/11 07:00

   APT29 Zero-Click Watering Hole Campaign Exploits Patched iOS and Android N-Day Flaws

   This article adds detail on which exploit chain targeted which iOS version, specifying that CVE-2025-43529 and CVE-2024-27834 affected iOS 16.7 while the second chain (CVE-2025-43529, CVE-2026-20700, CVE-2025-14174, CVE-2025-43510, CVE-2025-43520) affected iOS 18.5. It also provides new context on the DarkSword exploit kit, noting it was first documented by Sekoia in March 2026 and has been leveraged by multiple threat groups since at least November 2025, and reveals that none of the APT29 payloads in this campaign established persistence, so a device reboot halts the malicious activity until the victim revisits a compromised site.

   ler a análise desta fonte ocultar

   This article adds detail on which exploit chain targeted which iOS version, specifying that CVE-2025-43529 and CVE-2024-27834 affected iOS 16.7 while the second chain (CVE-2025-43529, CVE-2026-20700, CVE-2025-14174, CVE-2025-43510, CVE-2025-43520) affected iOS 18.5. It also provides new context on the DarkSword exploit kit, noting it was first documented by Sekoia in March 2026 and has been leveraged by multiple threat groups since at least November 2025, and reveals that none of the APT29 payloads in this campaign established persistence, so a device reboot halts the malicious activity until the victim revisits a compromised site.

   A large-scale watering hole campaign attributed with moderate-to-high confidence to the Russian threat group APT29 (Midnight Blizzard) targeted iOS and Android users visiting compromised or spoofed high-profile websites in the United States, Ukraine, Czech Republic, and Bulgaria. Compromised legitimate sites included a Ukrainian gas producer, a U.S. chemical industry trade association, and a Bulgarian military-related site, while lookalike domains impersonated the America250 and Raffles London at The OWO hotel sites in an adversary-in-the-middle setup. The attackers also compromised the Ukrainian web analytics service Plerdy, modifying its SEO tracker loaded by thousands of mostly Ukrainian websites between August 27 and September 3. In every vector, a JavaScript payload profiled visitors' devices and browsers, after which a command-and-control server pushed a platform-specific n-day exploit chain without requiring user interaction.

   Technical Details

   On iOS 16.7, the attackers used CVE-2025-43529 and CVE-2024-27834 to steal Safari cookies. On iOS 18.5, a chain of CVE-2025-43529, CVE-2026-20700, CVE-2025-14174, CVE-2025-43510, and CVE-2025-43520 harvested WhatsApp and Telegram databases, Keychain credentials, location data, and photos. On Chrome for Android (versions 139–145, excluding 143), CVE-2026-3910 and CVE-2025-27038 were used to deploy the AndroSnitch payload, collecting Chrome cookies, login data, browsing history, and saved WiFi credentials. Researchers also found four additional vulnerabilities present in unreachable code or alternate exploit paths that were not actually used. CVE-2025-43529 is tied to the DarkSword exploit kit, which Sekoia first documented in March 2026 and which multiple threat groups have leveraged since at least November 2025. None of the payloads observed in this APT29 campaign established persistence, meaning a simple device reboot halts the malicious activity until the victim revisits a compromised site. Attribution to APT29 rests on similarities to past watering-hole operations by the group, infrastructure overlaps, and a compromised site a partner previously linked to a 2025 APT29 campaign.

   Remediation

   Apple and Google have already patched all vulnerabilities exploited in this campaign, including backports to older iOS releases, so users should apply the latest available security updates for their devices. Because no persistence mechanism was used, rebooting an affected device also stops the malicious activity until the device visits a compromised site again.

7. sekoia.com ↗ · pub. 29/10/2026 13:14 · coletado 04/11 03:01 primeiro registro

   APT29 Watering Hole Campaign Uses Compromised Websites and Plerdy Supply-Chain Hack to Deliver N-Day Mobile Exploits

   ler a análise desta fonte ocultar

   Sekoia's Threat Detection & Research team uncovered a large-scale watering hole campaign, active since at least mid-October 2026, targeting mobile visitors of compromised or cloned high-profile websites in the United States, Ukraine, Czech Republic and Bulgaria. The intrusion set also compromised the Ukrainian web analytics service Plerdy between 27 August and 3 September 2026, exposing thousands of websites that embed its tracker and their visitors to the attackers' exploit infrastructure for one week. Three infection vectors (direct JavaScript injection on legitimate sites, Adversary-in-the-Middle-like lookalike proxy domains such as america250[.]holiday and theowo[.]club, and the Plerdy supply-chain compromise) all load the same fingerprinting payload, dubbed UltimateFingerprinter, which profiles the visitor's device and browser before serving platform-specific exploit chains without user interaction. Sekoia assesses with moderate-to-high confidence that the campaign is operated by APT29 (Midnight Blizzard, Cozy Bear, The Dukes), the Russia-nexus actor linked to the SVR, based on technical overlaps with a 2024 APT29 campaign against Mongolian government sites confirmed by Google TAG, victimology focused on Ukraine, and infrastructure patterns previously associated with the group.

   Technical Details

   The UltimateFingerprinter script is appended as dead code to a minified AngularJS library, collecting 394 fields from 61 collectors (canvas, WebGL, sensors, Apple-specific and modern Web-API fingerprints) before sending the data to an endpoint that returns exploit code only if basic device-plausibility checks pass; the fingerprint otherwise appears to have no bearing on exploit delivery. Three exploit chains were recovered, all relying exclusively on already-patched n-day vulnerabilities rather than zero-days: Class A targets iOS 16.7 (working range 16.0–17.4) using CVE-2025-43529 (WebKit RCE) and a PAC bypass via CVE-2024-27834 to steal cookies, with two unused dead-code exploits (CVE-2024-27808, CVE-2024-27833) left over from an earlier kit version. Class B is the full DarkSword exploit kit, previously uploaded to VirusTotal in September 2026 as a suspected commercial-surveillance-vendor product, chaining CVE-2025-43529, CVE-2026-20700 (PAC bypass), CVE-2025-14174 and CVE-2025-43510 (sandbox escape), and CVE-2025-43520 (kernel read/write) to exfiltrate SMS/iMessage, Mail, Voicemail, WhatsApp and Telegram databases, Keychain credentials, Wi-Fi passwords, contacts, calendar, Safari history/cookies, location data, Health data and photos; the kit also carries unused alternates CVE-2025-31277 and CVE-2025-24201. Class C targets Android Chrome versions 139–145 (excluding 143) via CVE-2026-3910 for renderer RCE followed by CVE-2025-27038 in the Adreno GPU driver for sandbox escape, deploying a shellcode dubbed AndroSnitch that steals Chrome cookies, login data, history and Wi-Fi configuration files, with a built-in check that halts exploitation on Samsung Galaxy S25 Ultra (SM-S938B) devices. All exfiltrated data is sent to ad.starx-net[.]com. All exploited CVEs had already been fixed by Apple and Google before the campaign began.

   Remediation

   Because every exploit chain in this campaign relies on previously patched n-day vulnerabilities, users and organizations running fully updated iOS and Android/Chrome versions are not vulnerable; keeping mobile operating systems and browsers current is the primary mitigation. Sekoia is coordinating with national CERTs of the affected countries to support victim identification and to assess disruption of the watering hole infrastructure.

Repetiram sem novidade

• olhardigital.com.br — CISA Adds Apple Pointer Authentication Bypass CVE-2024-27834 to KEV Amid APT29 Exploitation
• securityaffairs.com — CISA Adds Apple Pointer Authentication Bypass CVE-2024-27834 to KEV Catalog Amid APT29 Exploit Chain
• securityweek.com — Midnight Blizzard (APT29) Deploys Zero-Click iOS/Android N-Day Exploit Chains via Watering Holes in US, Ukraine, Czechia, Bulgaria
• securityonline.info — APT29 Deploys UltimateFingerprinter Profiler and N-Day Mobile Exploits via Watering Holes and Hijacked Plerdy Tracker