Rossiyalik xakerlar bilan bog'liq keng ko'lamli suv qudug'i (watering hole) hujumi buzilgan yoki haqiqiy portallarni taqlid qiluvchi soxta saytlarga kirgan iOS va Android foydalanuvchilarini nishonga olgan.
Kampaniya AQSh, Ukraina, Chexiya Respublikasi va Bolgariyadagi bir nechta yuqori darajadagi veb-saytlardan foydalangan bo'lib, ular tashrif buyuruvchilar va ularning qurilmalarini profil qilish uchun bir xil yuklamani yetkazib bergan.
Bu dastlabki bosqich hujumchiga "foydalanuvchi bilan o'zaro aloqasiz platformaga xos n-kunlik eksploit zanjirlarini" joylashtirish uchun brauzer versiyasini aniqlash imkonini beradi.
Sekoia kiberxavfsizlik kompaniyasi tadqiqotchilari operatsiyani o'rtacha-yuqori ishonch bilan APT29 (aka Midnight Blizzard) ga, ya'ni yaqinda mehmonxona WiFi hujumlari bilan bog'langan rossiyalik tahdid guruhiga bog'lashmoqda.
Ularning xulosalariga ko'ra, buzilgan haqiqiy saytlar Ukraina gaz ishlab chiqaruvchisi, AQSh kimyo sanoati savdo uyushmasi va Bolgariya harbiy bilan bog'liq saytga tegishli.
Soxta domenlar rasmiy America250 sayti va Raffles London at The OWO mehmonxonasini taqlid qilgan, haqiqiy saytlardan kontentni dushman-o'rtasida (adversary-in-the-middle) hujum modeli orqali uzatgan.
Tadqiqotchilar shuningdek, tahdid aktori Ukraina veb-analitika xizmati Plerdy ni buzib, uning SEO kuzatuvchisini o'zgartirganini aniqlashgan; bu kuzatuvchi 27-avgustdan 3-sentabrgacha, asosan Ukrainada, minglab veb-saytlar tomonidan yuklangan.
Barcha hollarda dastlabki yuklama veb-sayt tashrif buyuruvchilarini ularning qurilmalari va brauzer versiyalarini aniqlash uchun profil qiladigan JavaScript kodi bo'lgan. Keyin buyruq-va-nazorat (C2) serveri to'g'ri eksploit zanjirini yuborgan.
Kiritilgan JavaScript kodi Manba: Sekoia
Sekoia ma'lumotiga ko'ra, tahdid aktorlari cookie fayllari, xabar almashish ilovalari ma'lumotlar bazalari va hisob ma'lumotlarini olish uchun quyidagi zaifliklardan foydalangan:
- CVE-2025-43529 va CVE-2024-27834 (iOS 16.7 da). Yuklama Safari'da saqlangan cookie fayllarini nishonga oladi.
- CVE-2025-43529, CVE-2026-20700, CVE-2025-14174, CVE-2025-43510 va CVE-2025-43520 (iOS 18.5 da). Yuklama WhatsApp va Telegram ma'lumotlar bazalarini, Keychain hisob ma'lumotlarini, joylashuv ma'lumotlarini va fotosuratlarni yig'adi.
- CVE-2026-3910 va CVE-2025-27038 (Android uchun Chrome 139 dan 145 gacha, 143 dan tashqari). Chrome cookie fayllari, kirish ma'lumotlari, ko'rish tarixi va saqlangan WiFi hisob ma'lumotlarini yig'ish uchun AndroSnitch'dan foydalanadi.
Tadqiqotchilar yetib bo'lmaydigan kodda yoki muqobil eksploit yo'llarida yana to'rtta zaiflikni aniqlashgan, ammo ular tahlil qilingan zanjirlarda ishlatilmagan.
CVE-2025-43529 "DarkSword" eksploit to'plami bilan bog'liq bo'lib, u birinchi marta mart oyida hujjatlashtirilgan va 2025-yil noyabridan beri bir nechta tahdid guruhlari tomonidan hujumlarda ishlatilgan.
Sekoia ta'kidlashicha, APT29 ushbu hujumlarda ishlatgan yuklamalarning hech biri doimiylikni (persistence) o'rnatmagan, shuning uchun qurilmani qayta ishga tushirish zararli faoliyatni to'xtatadi, toki buzilgan saytga qayta kirilmaguncha.
APT29 ga bog'lash borasida Sekoia o'sha tahdid guruhi tomonidan o'tkazilgan avvalgi suv qudug'i operatsiyalari bilan o'xshashliklarni, infratuzilma kesishmalarini va hamkor tomonidan 2025-yilgi APT29 kampaniyasiga bog'langan buzilgan saytni qayd etadi.
Apple va Google ushbu kampaniyada nishonga olingan barcha kamchiliklarni tuzatgan, tuzatishlar hatto eski iOS versiyalariga ham yetib borgan, shuning uchun foydalanuvchilarga o'z qurilmalari uchun eng so'nggi xavfsizlik yangilanishlarini o'rnatish tavsiya etiladi.
Mavjud himoyalaringiz o'tkazib yuborishi mumkin bo'lgan elektron pochta tahdidlarini aniqlang.
Adaptive Security'ning AI agentlari elektron pochta niyatini, kontekstini va xulq-atvorini tahlil qilib, fishing, biznes elektron pochta buzilishi va hisob-faktura firibgarligini aniqlaydi.
Microsoft 365 yoki Google Workspace'ning 14 kunlik faqat o'qish skaneri bilan nima o'tib ketayotganini ko'ring, MX o'zgarishlarsiz.
Bepul elektron pochta xavfsizligi skaneringizni boshlang.
A large-scale watering hole attack associated with Russian hackers has been targeting iOS and Android users visiting compromised sites or fake ones impersonating legitimate portals.
The campaign used multiple high-profile websites in the U.S., Ukraine, the Czech Republic, and Bulgaria that delivered the same payload for profiling visitors and their devices.
This initial stage allows the attacker to determine the browser version to deploy "platform-specific n-day exploit chains without user interaction."
Researchers at cybersecurity company Sekoia attribute the operation with moderate-to-high confidence to APT29 (aka Midnight Blizzard), a Russian threat group that was recently linked to hotel WiFi attacks.
Based on their findings, compromised legitimate sites belong to a Ukrainian gas producer, a U.S. chemical industry trade association, and a Bulgarian military-related site.
Lookalike domains impersonated the official America250 site and Raffles London at The OWO hotel, relaying content from the real sites in an adversary-in-the-middle attack model.
The researchers also discovered that the threat actor had compromised Ukrainian web analytics service Plerdy and modified its SEO tracker, which was loaded by thousands of websites, mostly in Ukraine, between August 27 and September 3.
In all cases, the initial payload was JavaScript code that profiled website visitors to determine their devices and browser versions. The command-and-control (C2) server then pushed the correct exploit chain.
The injected JavaScript code Source: Sekoia
According to Sekoia, the threat actors exploited the following vulnerabilities to extract cookies, messaging app databases, and credentials:
- CVE-2025-43529 and CVE-2024-27834 (in iOS 16.7). The payload targets cookies stored in Safari.
- CVE-2025-43529, CVE-2026-20700, CVE-2025-14174, CVE-2025-43510, and CVE-2025-43520 (in iOS 18.5). The payload harvests WhatsApp and Telegram databases, Keychain credentials, location data, and photos.
- CVE-2026-3910 and CVE-2025-27038 (in Chrome for Android 139 to 145, excluding 143). Uses AndroSnitch to collect Chrome cookies, login data, browsing history, and saved WiFi credentials.
The researchers identified four other vulnerabilities in unreachable code or alternate exploit paths, but they were not used in the analyzed chains.
CVE-2025-43529 is linked to the “DarkSword” exploit kit, first documented in March, and leveraged in attacks since at least November 2025 by multiple threat groups.
Sekoia saysthat none of the payloads APT29 used in these attacks established persistence, allowing a device reboot to stop the malicious activity until visiting a compromised site again.
Regarding its attribution to APT29, Sekoia notes similarities to past watering-hole operations by the same threat group, infrastructure overlaps, and a compromised site that a partner linked to a 2025 APT29 campaign.
Apple and Google have patched all flaws targeted in this campaign, with fixes even reaching older iOS releases, so users are recommended to apply the latest available security updates for their devices.
Uncover email threats your existing defenses may miss.
Adaptive Security's AI agents analyze email intent, context, and behavior to uncover phishing, business email compromise, and invoice fraud.
See what's getting through with a 14-day read-only scan of Microsoft 365 or Google Workspace, with no MX changes.
Start your free email security scan.