The Morning Dev

Only the news worth knowing

‹
 

Security · High impactFan score 73 · Tier A8 sources

APT29's Watering Holes Target Thousands of Mobile Users

Dark Reading · By Jai Vijayan ·

APT29's Watering Holes Target Thousands of Mobile Users

The Brief

  • A Russia-linked group, presumed to be APT29, runs a large-scale watering hole campaign targeting iOS and Android users via compromised websites, fake domains and a supply-chain attack on a Ukrainian web analytics script (Plerdy SEO Tracker).
  • The campaign uses zero-click exploit chains built on previously patched n-day flaws, aimed at fingerprinting visitors and harvesting data from selected targets.
  • CISA added a medium-severity Apple flaw affecting multiple Apple operating systems to its KEV catalog after reports of active exploitation; sources say it is used to deliver info-stealing malware.

Why it matters

Visiting a compromised or spoofed website can be enough to infect a phone, even when the vendor has already shipped a fix, so unpatched devices remain exposed to state-level espionage tooling.

Who’s affected

  • iOS users running versions that predate the Apple fixes
  • Android users running unpatched builds
  • Organisations with staff in Ukraine, the US and Europe
  • Website operators who embed the Plerdy SEO Tracker script

What to do

  1. Update iOS and Android devices to the latest patched versions
  2. Check whether the Plerdy SEO Tracker script is embedded on your websites and remove or audit it
  3. Review websites for hijacked or fake-domain content and check for unauthorised script injections

After compromising websites, the Russian state-sponsored threat group is fingerprinting victims, then harvesting information from the interesting ones.

Read the full story at darkreading.com ↗

Timeline

  1. BleepingComputer, Ars Technica and The Hacker News report on the watering-hole campaign targeting iOS and Android users

  2. BleepingComputer

    Hackers use n-day exploits in zero-click attacks on iOS, Android devices

  3. The Hacker News

    APT29-Linked Hackers Hijack Web Analytics Script to Deliver iOS and Android Exploits

  4. Biz & IT - Ars Technica

    Hackers exploited iOS and Android flaws to infect phones

  5. CISA adds the medium-severity Apple flaw to its Known Exploited Vulnerabilities catalog

  6. The Hacker News

    Hackers Exploit Patched Apple Flaw to Deliver Info-Stealing Malware, CISA Says

  7. Security Affairs

    Russian APT29 Targets Mobile Users with Watering Hole Attacks

  8. SecurityWeek

    Russia-Linked Hackers Hit iOS, Android Devices With Exploit Chains via Watering Holes

  9. The Record from Recorded Future News

    Russian state-linked hackers target iPhone, Android devices in zero-click espionage campaign

  10. darkreading

    APT29's Watering Holes Target Thousands of Mobile Users

Full coverage · 8 sources

How do you feel about this?

0 Comments