Russia’s APT29 has been using compromised websites, lookalike domains and a hijacked web analytics service to target iOS and Android users with exploits for patched flaws and steal their cookies, messages and Wi-Fi passwords, according to Sekoia.
APT29 watering holes target mobile devices with n-day exploits (Source: Sekoia)
The company’s Threat Detection & Research (TDR) team spotted the operation in mid-October 2026. “This watering hole campaign, which we assess with moderate to high confidence to be linked to APT29, combines multiple web delivery vectors with n-day mobile exploit chains targeting Android and iOS devices,” the company stated. The group, also known as Midnight Blizzard or Cozy Bear, is tied to Russia’s Foreign Intelligence Service (SVR).
Over the summer, Microsoft reported that the group had spent months hijacking hotel and conference center Wi-Fi networks to steal Microsoft 365 credentials and deliver malware.
“This campaign relies on three infection vectors,” researchers wrote. “Direct JavaScript injection on legitimate websites, Adversary-in-the-Middle-like domains, and the supply-chain compromise of the Ukrainian web analytics service.”
“All three infection vectors deliver the same payload, a code injection that loads an external script to profile the visitor’s browser and device. The delivery host then uses the mobile and browser version to serve platform-specific n-day exploit chains without user interaction.”
Gas producers, hotels and military sites
The investigation started with a malicious script on the website of a Ukrainian gas production company. Further digging turned up more compromised sites, among them those of a US chemical industry trade association, a far-right European political party and a Bulgarian military-related organization.
Some, like the site of an Australian medical clinic, had no obvious strategic value, and the TDR team believes, with low confidence, that those may have been used to go after specific individuals.
Two lookalike domains loaded the legitimate pages of America250, the initiative marking 250 years of US independence, and of Raffles London at The OWO, a luxury hotel close to the UK Ministry of Defence and 10 Downing Street. The researchers believe the hotel clone may have been meant for diplomatic delegations and prominent guests, and mention open-source reporting that Ukrainian President Volodymyr Zelensky stayed there during a visit on 14 October.
For the widest reach, the attackers went after Plerdy, a Ukrainian analytics service, and spent a week between 27 August and 3 September 2026 serving their code through its tracking script. That script runs on thousands of websites, most of them Ukrainian, and the list includes sites run by the army, special forces and military equipment makers.
“It remains unclear whether the attackers intended to target visitors to specific websites or sought to compromise as many unpatched mobile devices as possible, indiscriminately exfiltrating data before selectively identifying and exploiting information of interest,” they noted.
“However, several of these sites are likely to attract high-value or strategically important visitors in the context of the Russia-Ukraine war.”
Three exploit chains for iOS and Android
On iPhones running iOS 16.7, the attackers chained CVE-2025-43529 and CVE-2024-27834 to steal cookies, which could let them reuse logged-in sessions and get into services such as webmail.
Devices with iOS 18.5 got a chain built on the DarkSword exploit kit, which uses CVE-2025-43529, CVE-2026-20700, CVE-2025-14174, CVE-2025-43510 and CVE-2025-43520 to take almost everything on the phone, from SMS, iMessage, WhatsApp and Telegram data to Keychain passwords, location data, health information and photos.
Android phones running Chrome versions 139 through 145 (except 143) were hit through CVE-2026-3910, a Chrome flaw, and CVE-2025-27038, a vulnerability in the Adreno graphics driver. That chain grabs Chrome cookies, saved logins, browsing history and Wi-Fi passwords. None of the payloads install anything that stays on the device after the data is sent out.
The attribution to APT29 rests on traces of a 2025 APT29 watering hole operation found on one of the compromised sites, similarities with a 2024 APT29 campaign against Mongolian government websites that Google’s Threat Analysis Group confirmed, and a victim list centered on Ukraine.
Every flaw in the three chains had been fixed before the campaign began, and Sekoia stressed that “a user running an up-to-date operating system is safe from these attacks.”
The company said it is working with the CERTs of the affected countries, CERT-UA among them, to identify victims and look for ways to disrupt the watering hole infrastructure.
“This operation also confirms the continued reuse of CSV mobile exploit frameworks, such as DarkSword, by state-sponsored intrusion sets. The adoption of packaged n-day exploit chains lowers the cost and technical threshold required to conduct advanced mobile exploitation. Over the long term, we assess that the proliferation and reuse of CSV exploits among state-sponsored intrusion sets will likely become more frequent,” Sekoia concluded.
