APT29 Watering Holes Target Unpatched iPhones and Android Devices
It assessed with moderate to high confidence that the group behind it is APT29, also tracked as Midnight Blizzard and Cozy Bear, or at least one of its subgroups.
It assessed with moderate to high confidence that the group behind it is APT29, also tracked as Midnight Blizzard and Cozy Bear, or at least one of its subgroups.
The group is widely attributed to Russia's Foreign Intelligence Service (SVR).
The campaign used three delivery routes: scripts injected into legitimate websites, lookalike domains that proxied real sites while adding scripts and a week-long compromise of Plerdy, a Ukrainian website analytics tracker.
The chains used n-day flaws, meaning vulnerabilities already disclosed and patched: CVE-2025-43529, CVE-2024-27834, CVE-2026-20700, CVE-2025-14174, CVE-2025-43510, CVE-2025-43520, CVE-2026-3910 and CVE-2025-27038.
Exposed sites included a Ukrainian gas producer, Ukrainian military and military-equipment sites, a US chemical-industry trade association, a Czech far-right movement and a Bulgarian military-related site.
Read more on Midnight Blizzard: Midnight Blizzard Targets Travelers via Captive Portals Plerdy is loaded by thousands of mostly Ukrainian websites.
Sekoia said the compromise, which ran from August 27 to September 3, exposed hundreds of them and their visitors to the exploit kit.
Visitors were fingerprinted and served exploit chains matched to their devices, and the payloads did not establish persistence, and sekoia said its analysis supported the idea that APT29 obtained the exploits from a third party.
What happened
It assessed with moderate to high confidence that the group behind it is APT29, also tracked as Midnight Blizzard and Cozy Bear, or at least one of its subgroups.
The group is widely attributed to Russia's Foreign Intelligence Service (SVR).
The campaign used three delivery routes: scripts injected into legitimate websites, lookalike domains that proxied real sites while adding scripts and a week-long compromise of Plerdy, a Ukrainian website analytics tracker.
What changed
The chains used n-day flaws, meaning vulnerabilities already disclosed and patched: CVE-2025-43529, CVE-2024-27834, CVE-2026-20700, CVE-2025-14174, CVE-2025-43510, CVE-2025-43520, CVE-2026-3910 and CVE-2025-27038.
Who is affected
Exposed sites included a Ukrainian gas producer, Ukrainian military and military-equipment sites, a US chemical-industry trade association, a Czech far-right movement and a Bulgarian military-related site.
Read more on Midnight Blizzard: Midnight Blizzard Targets Travelers via Captive Portals Plerdy is loaded by thousands of mostly Ukrainian websites.
Why it matters
Sekoia said the compromise, which ran from August 27 to September 3, exposed hundreds of them and their visitors to the exploit kit.
Technical details
Visitors were fingerprinted and served exploit chains matched to their devices, and the payloads did not establish persistence, and sekoia said its analysis supported the idea that APT29 obtained the exploits from a third party.
Attribution
Infosecurity Magazine: It assessed with moderate to high confidence that the group behind it is APT29, also tracked as Midnight Blizzard and Cozy Bear, or at least one of its subgroups.
What to watch next
Watch for additional victim details, indicators of compromise and follow-on exploitation reports.
Watch for revised vendor guidance, fixed versions and mitigation updates.