Security · High impactFan score 73 · Tier A8 sources

Russian APT29 Targets Mobile Users with Watering Hole Attacks

Security Affairs · By Pierluigi Paganini · 1d ago

The Brief

A Russia-linked group, presumed to be APT29, runs a large-scale watering hole campaign targeting iOS and Android users via compromised websites, fake domains and a supply-chain attack on a Ukrainian web analytics script (Plerdy SEO Tracker).
The campaign uses zero-click exploit chains built on previously patched n-day flaws, aimed at fingerprinting visitors and harvesting data from selected targets.
CISA added a medium-severity Apple flaw affecting multiple Apple operating systems to its KEV catalog after reports of active exploitation; sources say it is used to deliver info-stealing malware.

Why it matters

Visiting a compromised or spoofed website can be enough to infect a phone, even when the vendor has already shipped a fix, so unpatched devices remain exposed to state-level espionage tooling.

Who’s affected

iOS users running versions that predate the Apple fixes
Android users running unpatched builds
Organisations with staff in Ukraine, the US and Europe
Website operators who embed the Plerdy SEO Tracker script

What to do

Update iOS and Android devices to the latest patched versions
Check whether the Plerdy SEO Tracker script is embedded on your websites and remove or audit it
Review websites for hijacked or fake-domain content and check for unauthorised script injections

#apple
#android
#watering-hole
#apt29
#zero-click
#supply-chain

Russia-linked group APT29 targeted iOS and Android users through hijacked websites and a compromised analytics service. Sekoia says a large-scale watering hole campaign is going after iOS and Android users, and it links the campaign to APT29 (aka SVR group , Cozy Bear , Nobelium…

Read the full story at securityaffairs.com ↗