APT29 Campaign Used Watering Holes to Target Mobile Users
Summary
Sekoia says APT29 used compromised and lookalike sites, plus a poisoned analytics script, to fingerprint iOS and Android users and deliver platform-specific exploits that could steal sensitive data.
Key points
- Sekoia reported that APT29 used three delivery vectors: compromised legitimate websites, lookalike sites, and malicious code injected into Ukrainian analytics firm Plerdy’s tracking script.
- The campaign potentially exposed visitors to thousands of websites, most of them Ukrainian, to device-fingerprinting and exploit-delivery infrastructure.
- The fingerprinting code collected device and browser data and sent it to an APT29 command-and-control service, which selected an exploit chain based on the mobile platform and software versions.
- On iOS 16.7, the reported chain used CVE-2025-43529 and CVE-2024-27834 to steal browser cookies; on iOS 18.5, a five-vulnerability DarkSword chain could collect a broader range of sensitive data.
- Sekoia said indicators linked the campaign to APT29 and suggested the group may have obtained exploits from a third party, possibly a commercial surveillance vendor.
- Sekoia warned that packaged, reused exploit chains could make advanced mobile exploitation more accessible to state-sponsored groups.
Article Details
- Event Type
- APT29 watering-hole campaign targeting mobile users through compromised websites, lookalike domains, and a compromised website-analytics script.
- Impact
- The campaign potentially exposed thousands of iOS and Android users to device fingerprinting and exploit delivery. On vulnerable devices, reported exploit chains could steal browser cookies or collect sensitive data including messages, passwords, authentication tokens, credentials, call history, contacts, calendar entries, notes, and photos. The article does not establish the total number of successfully compromised devices or the amount of data actually exfiltrated.
MITRE ATT&CK
T1189 · Drive-by CompromiseAPT29 reportedly compromised legitimate websites and used lookalike sites to expose visitors to malicious code and exploit delivery.T1195.002 · Compromise Software Supply ChainAPT29 reportedly compromised Plerdy's website-analytics tracking script, potentially exposing visitors to sites using it.
CVE
CVE-2024-27834Apple · iOS and iPadOS; apple · ipad_os; +5 moreadvantage of CVE-2025-43529 (a vulnerability that the DarkSword exploit kit abused previously) and CVE-2024-27834 to steal iOS browser cookies. On devices running iOS 18.5, the threat group delivered the fullCVE-2025-43529Apple · iOS and iPadOS; Apple · macOS; +4 moreOn vulnerable iOS 16.7 devices, APT29's exploit chain took advantage of CVE-2025-43529 (a vulnerability that the DarkSword exploit kit abused previously) and CVE-2024-27834 to steal iOS browser cookies. On devices
Threat Actors
Cozy BearThe article identifies Cozy Bear as an alias of APT29, which it attributes with the watering-hole campaign and mobile exploit delivery.ICE RELICThe article attributes the watering-hole campaign and mobile exploit delivery to APT29, while noting Sekoia's assessment that the group may have obtained exploits from a third party.Midnight BlizzardThe article identifies Midnight Blizzard as an alias of APT29, which it attributes with the watering-hole campaign and mobile exploit delivery.
Vendors
Products
Androidthe access to distribute malicious device-fingerprinting code to potentially thousands of iPhone and Android users.iOSIn its latest campaign, APT29 used three separate infection vectors to target iOS and Android devices. One involved compromising legitimate websites and injecting malicious JavaScript that exposed visitors to a
Tools
Countries
RussiaIt has emerged this week that Russia's APT29 threat group compromised the website of a Ukrainian SEO and website analytics service, and briefly used the access to distribute malicious device-fingerprinting code toUkraineanalysis," Sekoia's threat research and intelligence team wrote. "While the victimology shows a focus on Ukraine and the United States, the inclusion of unrelated entities such as an Australian medical clinicUnited Statesthreat research and intelligence team wrote. "While the victimology shows a focus on Ukraine and the United States, the inclusion of unrelated entities such as an Australian medical clinic complicates a broad
Industries
Chemicalscript. Among the websites the threat actor turned into watering holes were those of a US chemical-industry trade association, a Ukrainian gas producer, and a Bulgarian military-related organization.Healthcarewith a focus on government agencies, diplomatic organizations, think tanks, technology companies, healthcare, and research institutions.Technologyon behalf of Moscow, with a focus on government agencies, diplomatic organizations, think tanks, technology companies, healthcare, and research institutions.