A large-scale watering hole campaign attributed to Russian threat group APT29 has targeted iOS and Android users via compromised websites and lookalike domains.
By Hermes-Vector AI Desk
A large-scale watering hole attack has been targeting iOS and Android users who visit compromised websites or fake sites impersonating legitimate portals, according to reports from BleepingComputer and Mezha.net.
The campaign utilized high-profile websites in the United States, Ukraine, the Czech Republic, and Bulgaria to deliver a payload designed to profile visitors and their devices. This initial stage allows the attacker to determine the browser version to deploy "platform-specific n-day exploit chains without user interaction," according to Sekoia.
In these attacks, the initial payload is JavaScript code that identifies the visitor's device and browser version. A command-and-control (C2) server then pushes a specific exploit chain tailored to that device. Researchers at Sekoia noted that none of the payloads used by the threat actor established persistence, meaning a device reboot stops the malicious activity until the user visits a compromised site again.
According to Sekoia, the threat actors exploited specific vulnerabilities to extract credentials, cookies, and messaging app databases:
Researchers at Sekoia attribute the operation with "moderate-to-high confidence" to APT29 (also known as Midnight Blizzard), a Russian threat group. Sekoia cited infrastructure overlaps and similarities to past watering-hole operations by the same group as reasons for this attribution.
Compromised legitimate sites identified by researchers include a Bulgarian military-related site, a U.S. chemical industry trade association, and a Ukrainian gas producer. Additionally, the attackers compromised the Ukrainian web analytics service Plerdy, modifying its SEO tracker which was loaded by thousands of websites, mostly in Ukraine, between August 27 and September 3.
Lookalike domains were also used to impersonate the official America250 site and Raffles London at The OWO hotel, employing an adversary-in-the-middle attack model to relay content from the real sites.
Apple and Google have patched all flaws targeted in this campaign, with fixes reaching older iOS releases. Security experts recommend that users apply the latest available security updates for their devices.
Sources
This article was drafted with AI assistance and checked against the sources above. Company claims are reported as claims. Cover image is AI-generated.
The day's checked news, by email
One short email a day with the top stories. Free, and you can unsubscribe in one click.
Or follow for the latest news:
No comments yet. Start the discussion.
TechTrending
Authorities in South Korea have booked 80 individuals for allegedly using unauthorized devices to unlock Tesla's Full Self-Driving feature.
TechTrending
The Seoul Metropolitan Police Agency has booked 80 people for using aftermarket devices to activate Tesla's Full Self-Driving software on unauthorized vehicles.
