cyber.hendryadrian.com
Security News · databreachtoday.com

Sekoia Attributes Mobile Watering-Hole Campaign to Russia’s APT29

· Original article ↗

Summary

Sekoia attributes with moderate to high confidence a mobile watering-hole campaign to Russia’s APT29, which used compromised or look-alike sites and known vulnerabilities to steal browser cookies and other data.

Key points

  • Sekoia detected the campaign in mid-October and attributed it with moderate to high confidence to Russia’s Foreign Intelligence Service, also tracked as APT29.
  • The campaign targeted high-profile sites, including organizations in Ukraine, the United States and Bulgaria, and compromised a Ukrainian web analytics service.
  • Attackers used JavaScript injected into legitimate sites and phishing domains acting as reverse proxies; they exploited known, already-patched vulnerabilities on out-of-date devices.
  • Researchers linked delivery infrastructure across the campaign’s three infection vectors by finding a reused malicious JavaScript filename and using internet indexing and scanning platforms.
  • A joint investigation found traces matching an earlier watering-hole campaign attributed to the same group; Sekoia also cited matching tactics, infrastructure and victimology.
  • The campaign focused on intelligence collection rather than persistence; stolen browser cookies could enable access to webmail, cloud services and internal portals.

Article Details

Event Type
Large-scale watering hole campaign attributed with moderate to high confidence by Sekoia researchers to Russia's Foreign Intelligence Service, tracked as APT29, Cozy Bear, and Midnight Blizzard. The campaign used compromised or look-alike websites, JavaScript injection, and phishing domains acting as reverse proxies to target mobile devices and steal browser cookies and other data.
Impact
Stolen browser authentication cookies could enable access to corporate webmail, cloud collaboration suites, and internal portals without a password or triggering multifactor authentication. Stolen social media and text-message logs, contacts, and other secrets could support spear-phishing, account takeovers, or network access. The source describes these as potential consequences; the actor reportedly focused on intelligence collection rather than persistence.

MITRE ATT&CK

T1059.007 · JavaScriptThe campaign used malicious JavaScript injected into legitimate websites.T1189 · Drive-by CompromiseThe campaign used compromised websites as watering holes to deliver malicious JavaScript to visitors.T1539 · Steal Web Session CookieThe campaign stole browser authentication cookies to enable access to web accounts and portals.

People

Amaury-Jacques GARÇONSekoia researcher who discussed the campaign, its targeting rationale, and the evidence supporting attribution.

Threat Actors

Cozy BearThe article identifies Cozy Bear as another name used for the group tracked as APT29, which Sekoia attributed to the campaign with moderate to high confidence.ICE RELICThe campaign was attributed with moderate to high confidence to the group tracked as APT29; the article says it is also tracked as Cozy Bear and Midnight Blizzard.Midnight BlizzardThe article identifies Midnight Blizzard as another name used for the group tracked as APT29, which Sekoia attributed to the campaign with moderate to high confidence.Russia's Foreign Intelligence ServiceSekoia researchers identified Russia's Foreign Intelligence Service as the perpetrator with moderate to high confidence.

Vendors

Plerdyto high-profile websites. Hackers also compromised a web analytics tool made by the Ukrainian company Plerdy. The threat actor exploited known, already-patched vulnerabilities in each attack, targeting out-of-date

Tools

Censysthose servers, and using internet indexing and scanning platforms - such as URLScan, PublicWWW, URLQuery, Censys and Shodan - we were able to identify a large number of victims across all three infection vectors, allPublicWWW"From those servers, and using internet indexing and scanning platforms - such as URLScan, PublicWWW, URLQuery, Censys and Shodan - we were able to identify a large number of victims across all three infection vectors,Shodanand using internet indexing and scanning platforms - such as URLScan, PublicWWW, URLQuery, Censys and Shodan - we were able to identify a large number of victims across all three infection vectors, all pointingURLQuery"From those servers, and using internet indexing and scanning platforms - such as URLScan, PublicWWW, URLQuery, Censys and Shodan - we were able to identify a large number of victims across all three infection vectors,urlscan.io"From those servers, and using internet indexing and scanning platforms - such as URLScan, PublicWWW, URLQuery, Censys and Shodan - we were able to identify a large number of victims across all three infection vectors,

Countries

RussiaResearchers from cybersecurity firm Sekoia identify with moderate to high confidence Russia's Foreign Intelligence Service as the perpetrator, a group tracked variously as APT29, Cozy Bear and Midnight Blizzard. SekoiaUkraineSekoia contacted Ukraine's incident response team CERT-UA and an unnamed partner organization. The joint investigation confirmed that traces on one of the compromised websites matched an earlier watering hole campaignUnited Stateswebsites, including those of a Ukrainian gas production firm, a trade association representing U.S. chemical companies, America250 and a Bulgarian military-related organization. It also compromised a

Related Articles