Russian State-Sponsored Hackers Compromise Thousands of Mobile Devices Through Watering Hole Campaign
A sophisticated cyberattack campaign attributed to Russia’s APT29 threat group has compromised thousands of mobile devices, exposing users to sensitive information harvesting and potential exploitation. The attack, which leveraged compromised websites and created lookalike domains, injected malicious code that collected device and browser data from Android and iOS devices.
The campaign, uncovered by researchers at Sekoia, used a three-pronged approach to target iPhone and Android users. First, APT29 compromised legitimate websites, including those of a Ukrainian SEO and website analytics service, as well as other sites in the US, Ukraine, and Bulgaria. Visitors to these sites were exposed to a device-fingerprinting script that collected data on their devices and sent it to an APT29 command-and-control server.
The second vector involved creating lookalike domains that impersonated legitimate websites, including the America250 national celebration website and London’s Raffles hotel. These fake sites injected malicious code that also harvested device information from visitors. The third vector targeted Ukrainian website analytics firm Plerdy, which has thousands of clients across Ukraine. By injecting malware into Plerdy’s tracking script, APT29 potentially exposed visitors to its device-fingerprinting and exploit-delivery infrastructure.
Once the device data was collected, APT29 delivered one of three different exploit chains depending on the mobile platform and browser/OS versions. The exploits targeted specific vulnerabilities in iOS or Android that had remained unpatched on the exposed devices. On vulnerable iOS 16.7 devices, for example, the threat group stole iOS browser cookies using two previously known vulnerabilities.
The APT29 campaign raises concerns about the sophistication of state-sponsored hackers and their ability to compromise even seemingly secure mobile platforms. With no clear targeting pattern emerging from the analysis, it appears that APT29 was focused on infecting as many vulnerable phones as possible rather than targeting specific individuals or organizations.
This attack serves as a reminder for mobile users to remain vigilant about website security and to ensure they are running up-to-date software. By regularly updating their devices and browsers, users can reduce the risk of falling victim to exploits like those used by APT29. Additionally, being cautious when visiting unfamiliar websites and avoiding suspicious links or downloads is crucial in preventing similar attacks from succeeding.
Source: Dark Reading — 2026-11-05