Cyberespionage Campaign Linked to Russian APT29 Targets Mobile Devices
A recent cyberespionage campaign linked to APT29, a group suspected of being associated with Russia’s Foreign Intelligence Service (SVR), has raised significant alarm due to its innovative use of exploit chains on previously patched vulnerabilities in both iPhone and Android devices. This campaign, which stealthily serves malicious payloads to visitors of seemingly legitimate websites, aims to harvest sensitive information such as cookies, device data, and Wi-Fi passwords, doing so without requiring any interaction from users.
Discovery and Attribution
The activity was unearthed by cybersecurity researchers from Sekoia in mid-October 2026, with details emerging in a comprehensive report published on November 4. The firm expresses moderate to high confidence in the attribution to APT29, which is also known by alternate monikers such as Midnight Blizzard and Cozy Bear. This recognition stems from the group’s historical affiliation with Russian state-sponsored cyberspace operations, consistently targeting governmental and corporate entities across the globe.
Methods of Delivery
The cyberespionage campaign utilized a multifaceted approach for delivering its malicious payloads. It exploited three primary delivery methods:
-
Scripts on Legitimate Websites: By injecting harmful scripts into credible platforms, the attackers could reach a wide audience without raising suspicion.
-
Impersonation through Lookalike Domains: These domains mimicked real websites while embedding malicious scripts, further expanding the attack’s reach and effectiveness.
- Compromise of Plerdy: The attack was significantly bolstered by the compromise of Plerdy, a Ukrainian website analytics tracker. This breach lasted from August 27 to September 3 and affected numerous sites, exposing visitors to the exploit toolkit.
The compromised sites included those owned by a Ukrainian gas producer, military and defense organizations, a U.S. chemical-industry trade association, and various others, showcasing the extensive list of potential victims. Notably, the attackers also created lookalike domains masquerading as the America250 initiative and a London hotel, broadening their attack vector further.
Impact of the Plerdy Compromise
Sekoia’s analysis indicates that the breach of Plerdy exposed hundreds of sites primarily belonging to Ukrainian entities. Such infiltration highlights the operational capabilities of APT29, as thousands of domains depend on Plerdy’s analytics functionalities. However, the exact number of compromised devices remains unspecified, raising concerns about the breadth of the threat landscape created by this campaign.
Moreover, this operation stands out from a prior APT29 initiative in that it lacked a hardcoded filter targeting specific websites. A previous report from Google noted that an earlier operation focused on Mongolian governmental sites, whereas this current endeavor indiscriminately captured cookies from any device visiting the affected sites.
Exploited Vulnerabilities
While the campaign’s implications are severe, it is crucial to note that all exploits leveraged in this operation were based on vulnerabilities that had already been disclosed and patched. For instance, one exploit targeted iOS 16.7, intending to steal cookies, while another, linked to the DarkSword exploit kit, aimed at devices running iOS 18.5 to collect comprehensive device data. A third exploit focused on Chrome versions 139 to 145 on Android devices, enabling the harvesting of browser cookies and Wi-Fi credentials.
The vulnerabilities targeted fall under the classification of n-day flaws, which indicates that they had been previously addressed by patches. Specifically, the campaign exploited vulnerabilities identified as CVE-2025-43529, CVE-2024-27834, CVE-2026-20700, CVE-2025-14174, CVE-2025-43510, CVE-2025-43520, CVE-2026-3910, and CVE-2025-27038. This leads Sekoia to suggest that APT29 likely acquired these exploits from a third party, thereby indicating a reliance on external sources for their operations.
Conclusion: Mitigation and Threat Awareness
Despite the serious nature of this campaign, Sekoia emphasizes a crucial point regarding user safety. According to their analysis, individuals operating with up-to-date operating systems are at reduced risk from these attacks. As awareness of APT29’s activities grows, the emphasis on maintaining current software versions and employing effective cybersecurity measures becomes increasingly vital for individuals and organizations alike. The implications of this sophisticated cyber campaign necessitate ongoing vigilance in cybersecurity practices to combat the evolving threats posed by such advanced persistent threats.