Sekoia Connects Recent Cyber Campaign to Russian Espionage Group Targeting Mobile Users
In a concerning revelation from cybersecurity experts at Sekoia, recent findings have linked a large-scale cyber operation to a Russian intelligence group known as APT29 (also referred to as Cozy Bear or Midnight Blizzard). The operation, characterized as a watering hole campaign, aimed at iOS and Android users by exploiting compromised and look-alike websites to access sensitive data.
Using an array of techniques, the hackers carried out the operation with alarming efficiency. Sekoia’s researchers first identified the campaign in mid-October, raising concerns within the cybersecurity community due to the sophistication and breadth of the attacks. Notably, the hackers targeted an array of high-profile websites, including those affiliated with a Ukrainian gas production firm, the American trade association for chemical companies, America250, and a Bulgarian military organization. Additionally, they compromised a third-party web analytics service based in Ukraine, further extending the reach of their attacks to numerous websites.
Amaury-Jacques Garçon, a researcher at Sekoia, emphasized that the diversity of targets might seem puzzling at first glance. However, the true narrative of the campaign unfolds when viewed through the lens of individual-centric targeting. Instead of a random selection of sites, attackers strategically compromised websites frequented by individuals of interest, exhibiting a calculated approach to intelligence gathering.
The mechanics of the campaign involved inserting malicious JavaScript into legitimate websites and registering phishing domains that functioned as reverse proxies to high-profile sites. This strategy allowed the hackers to intercept browser cookies and other critical data. By taking advantage of known vulnerabilities that were already patched, they targeted devices that had not yet been updated, demonstrating a clear disregard for user security.
Researchers from Sekoia deduced the timeline and structure of the campaign through the reuse of filenames for the malicious JavaScript. This consistent identifier facilitated a deeper investigation into other servers controlled by the attackers. By utilizing internet indexing and scanning tools such as URLScan, PublicWWW, URLQuery, Censys, and Shodan, they were able to identify numerous victims across three distinct infection vectors, with many connections tracing back to the same malicious infrastructure.
Further collaboration with Ukraine’s incident response team, CERT-UA, and an unnamed partner organization confirmed that remnants of the attack matched earlier watering hole campaigns attributed to the same Russian espionage group. This correlation not only bolstered the attribution but also highlighted the cyber group’s extended history of targeting specific entities.
Garçon outlined that the findings pointed to a pattern of tactics, techniques, and procedures (TTPs) that mirrored APT29’s past activities, particularly a 2024 campaign directed against the Mongolian government. The use of various autonomous systems, combined with a victimology aligned with Russian strategic interests, further solidified the attribution of this operation to Russian state-supported hackers.
Notably, these attacks are designed not to implant persistent malware on the compromised devices but rather to focus on intelligence collection. This approach allows the threat actors to utilize compromised information as a means to facilitate identity theft or cloud-based intrusions. The stolen browser cookies, for instance, can grant attackers access to corporate webmail, cloud collaboration tools, and internal portals—essentially bypassing the need for passwords or triggering multifactor authentication, which heightens the risk for affected organizations.
The implications of stolen data go beyond mere access; they can serve as a launchpad for spear-phishing attacks as social media interactions and text messaging logs can be exploited. Additionally, the data gleaned from these attacks can lead to account takeovers, providing the hackers with extensive network-level access to targeted systems.
In response to these alarming findings, Sekoia has reached out to approximately 25 hosting companies and service providers to initiate the takedown of the malicious domains and associated IP addresses linked to this operation. The cybersecurity landscape continues to evolve as threat actors leverage increasingly complex techniques to target organizations and individuals alike, raising critical questions about security preparedness in an era where digital vulnerabilities are regularly exploited. The revelations regarding APT29’s recent tactics highlight the urgent need for individuals and companies to remain vigilant against potential cyber threats, ensuring that strong security measures are in place to protect sensitive information from these sophisticated adversaries.