Rossiya xakerlari mobil ekspluatatsiyalar bilan tashrif buyuruvchilarni nishonga olish uchun soxta AQSh va Buyuk Britaniya veb-saytlarini yaratdi

Sekoia o'rtacha va yuqori ishonch bilan baholagan keng ko'lamli watering hole (suv ichish joyi) kampaniyasi APT29 ishidir.

APT29 shuningdek Midnight Blizzard, Cozy Bear va The Dukes nomlari bilan ham kuzatiladi va keng tarqalgan holda Rossiyaning SVR tashqi razvedka xizmati bilan bog'lanadi.

Operatsiya iOS va Android foydalanuvchilariga buzilgan saytlar, klonlangan domenlar va zaharlangan analitika xizmati orqali zarba berdi. U to'liq yamalgan n-day (n-kunlik) zaifliklarga tayanib ishladi, shuning uchun to'liq yangilangan qurilmalar xavf ostida emas.

Ikkinchi vektor — adversary-in-the-middle (dushman-o'rtada) uslubidagi teskari proksi to'plami edi. america250[.]holiday Amerika250 mustaqillik yubileyi saytini aks ettiradi, theowo[.]club esa Mudofaa vazirligi va 10 Downing Street yaqinidagi mehmonxona — London The OWO'dagi Raffles Londonni aks ettiradi.

Sekoia luralar diplomatlar va rasmiy shaxslarni spear-phishing (maqsadli fishing) orqali nishonga olgan deb gumon qiladi.

Uchinchi vektor — Ukrainaning Plerdy SEO Tracker'ining ta'minot zanjiri buzilishi edi. 2026-yil 27-avgustdan 3-sentabrgacha hujumchilar a.plerdy[.]com'ning treker faylini o'zgartirib, har bir tashrif buyuruvchi ham ularning barmoq izini olish skriptini yuklashiga sabab bo'lishdi.

Trekerni ishlatgan saytlar orasida harbiy va mudofaa uskunalari sahifalari ham bor edi.

Uchala vektor ham "UltimateFingerprinter" skriptini yuklaydi — bu skript taxminan 2,3 MB o'lik AngularJS kodi ortida yashiringan. Sekoia bu to'ldirish LLM-ga asoslangan tahlilni qiyinlashtirishi mumkin deb taxmin qiladi.

.webp)

APT29 kampaniyasi (Manba: Sekoia).

Skript 61 kollektor orqali 394 maydonni yig'adi va serverga yuboradi. Ushbu server faqat asosiy tekshiruvlar o'tsa, masalan, ishonchli telefon ekran o'lchami va nolga teng bo'lmagan tegish nuqtalari soni bo'lsa, ekspluatatsiyani qaytaradi.

Sekoia barmoq izining qolgan qismi yetkazib berishga ta'sir qilganini ko'rmadi.

A zanjiri iOS 16.7 ni CVE-2025-43529 va CVE-2024-27834 bilan nishonga oladi va cookie-fayllarni o'g'irlaydi. B zanjiri iOS 18.5 ni nishonga oladi va to'liq DarkSword to'plamidir.

U CVE-2026-20700, CVE-2025-14174, CVE-2025-43510 va CVE-2025-43520 ni qo'shadi va butun qurilmani yig'ib oladi.

Bunga xabarlar, WhatsApp va Telegram ma'lumotlar bazalari, Keychain sirlar, Wi-Fi parollari, joylashuv keshlar, fotosuratlar va iCloud Drive kiradi.

Sekoia faoliyatni topdi, birinchi vektor qonuniy saytlarga to'g'ridan-to'g'ri JavaScript in'ektsiyasi edi, jumladan, Ukraina gaz ishlab chiqaruvchisi, AQSh kimyo sanoati savdo uyushmasi va Bolgariya harbiy bilan bog'liq sayt.

C zanjiri Android Chrome 139–145 (143 dan tashqari) ni CVE-2026-3910 va CVE-2025-27038, Adreno GPU drayveri zaifligi yordamida uradi.

Uning yakuniy yuklamasi, Sekoia AndroSnitch deb nomlagan, Chrome cookie-fayllari, saqlangan kirish ma'lumotlari, tarix va Wi-Fi konfiguratsiyasini o'g'irlaydi. Barcha zanjirlar ma'lumotlarni ad.starx-net[.]com:8881/telemetry/v12 ga yuboradi va hech qanday doimiylik o'rnatmaydi.

Google'ning tahdid razvedka guruhi 2026-yil mart oyida DarkSword'ni iOS 18.4–18.7 ni qo'llab-quvvatlovchi iOS zanjiri sifatida ta'riflagan. U oltita zaiflikdan foydalanadi, ularning bir nechtasi nol-kunlik ekspluatatsiya sifatida ishlatilgan.

U tijorat kuzatuv sotuvchilari va shubhali davlat aktyorlari tomonidan qabul qilingan. Google UNC6353, shubhali Rossiya josuslik klasteri, uni Ukraina saytlariga watering hole hujumlariga qo'shganini qayd etdi. Apple iOS 26.3 gacha barcha zaifliklarni yamadi.

Sekoia dalillari orasida fayllari 2025-yilgi APT29 watering hole haqida xususiy hisobotga mos keladigan buzilgan sayt ham bor. Google TAG ham ramkaning APT29'ning 2024-yilgi Mo'g'uliston hukumat saytlariga qarshi kampaniyasiga o'xshashligini tasdiqladi.

Ushbu kampaniya NSO Group va Intellexa zaifliklari bilan bir xil yoki hayratlanarli darajada o'xshash n-day ekspluatatsiyalaridan foydalangan va iOS hamda Android Chrome'dan cookie-fayllarni o'g'irlagan.

2024-yilgi versiya faqat veb-pochta va kirish saytlarining qattiq kodlangan ro'yxatini nishonga olgan. Yangi kampaniya har qanday cookie-ni yig'adi.

Jabrlanuvchilar Rossiya manfaatlariga mos keladi, Ukraina va AQShga e'tibor qaratilgan. Sekoia shuningdek, o'ng qanot Chexiya partiyasi sayti buzilganini ham topdi, bu APT29'ning Yevropa siyosiy partiyalarini nishonga olish tarixi bilan mos keladi.

Mandiant bu naqshni 2024-yilgi WINELOADER fishing kampaniyasida Germaniya partiyalariga qarshi hujjatlashtirgan.

O'g'irlangan cookie-fayllar hujumchilarga autentifikatsiyalangan sessiyalarni qayta ishlatish va parolsiz veb-pochtaga kirish imkonini beradi. Sekoia jabrlanuvchilarni aniqlash va mumkin bo'lgan infratuzilmani buzish bo'yicha ta'sirlangan mamlakatlar CERT'lari bilan ishlamoqda.

Himoyachilar iOS va Chrome'ni yangilashlari va ko'rsatilgan domenlarni bloklashlari kerak. Google yangilanish mumkin bo'lmagan hollarda Lockdown Mode (Qulflash rejimi) ni ham tavsiya qiladi.

Tarmoq jamoalari starx-net, flux-telemetry va clouds-stacks domenlari uchun ov qilishlari va Plerdy trekeridan foydalanishni ko'rib chiqishlari kerak.

IOC'lar

Eslatma: IP manzillar va domenlar tasodifiy hal qilish yoki giperhavola qilishning oldini olish uchun ataylab defanged (masalan, [.]) qilingan. Faqat nazorat qilinadigan tahdid razvedka platformalarida, masalan MISP, VirusTotal yoki SIEM'da qayta fangled qiling.

A large-scale watering hole campaign that it assesses, with moderate to high confidence, is the work of APT29.

APT29 is also tracked as Midnight Blizzard, Cozy Bear and The Dukes, and is widely linked to Russia’s SVR foreign intelligence service.

The operation hit iOS and Android users through compromised sites, cloned domains, and a poisoned analytics service. It relied entirely on patched n-day flaws, so fully updated devices are not exposed.

The second was a set of adversary-in-the-middle-style reverse proxies. america250[.]holiday mirrors the America250 independence-anniversary site, and theowo[.]club mirrored Raffles London at The OWO, a hotel near the Ministry of Defence and 10 Downing Street.

Sekoia suspects the lures targeted diplomats and officials through spear-phishing.

The third vector was a supply-chain compromise of Ukraine’s Plerdy SEO Tracker. Between 27 August and 3 September 2026, attackers modified a.plerdy[.]com’s tracker file so every visitor also loaded their fingerprinting script.

Sites using the tracker included military and defence-equipment pages.

All three vectors load “UltimateFingerprinter,” a script hidden behind roughly 2.3 MB of dead AngularJS code. Sekoia suggests this padding may hinder LLM-based analysis.

.webp)

APT29 campaign (Source : Sekoia).

The script gathers 394 fields through 61 collectors and posts them to a server. That server returns an exploit only if basic checks pass, such as a plausible phone screen size and a non-zero touch-point count.

Sekoia saw no sign that the rest of the fingerprint affected delivery.

Chain A targets iOS 16.7 with CVE-2025-43529 and CVE-2024-27834, and steals cookies. Chain B targets iOS 18.5 and is the full DarkSword kit.

It adds CVE-2026-20700, CVE-2025-14174, CVE-2025-43510 and CVE-2025-43520, and harvests the entire device.

That includes messages, WhatsApp and Telegram databases, Keychain secrets, Wi-Fi passwords, location caches, photos and iCloud Drive.

Sekoia found the activity, the first vector was direct JavaScript injection into legitimate sites, including a Ukrainian gas producer, a US chemical-industry trade association, and a Bulgarian military-related site.

Chain C hits Android Chrome 139–145 (excluding 143) using CVE-2026-3910 and CVE-2025-27038, an Adreno GPU driver flaw.

Its final payload, which Sekoia dubbed AndroSnitch, exfiltrates Chrome cookies, saved logins, history and Wi-Fi configuration. All chains send data to ad.starx-net[.]com:8881/telemetry/v12 and establish no persistence.

Google’s threat intelligence group described DarkSword in March 2026 as an iOS chain supporting iOS 18.4–18.7. It uses six vulnerabilities, several of which were exploited as zero-days.

It has been adopted by commercial surveillance vendors and suspected state actors. Google noted that UNC6353, a suspected Russian espionage cluster, had added it to watering hole attacks on Ukrainian sites. Apple patched all the flaws by iOS 26.3.

Sekoia’s evidence includes a compromised site whose files matched a private report on a 2025 APT29 watering hole. Google TAG also confirmed the framework resembles APT29’s 2024 campaign against Mongolian government sites.

That campaign used n-day exploits identical or strikingly similar to those of NSO Group and Intellexa, and it stole cookies from iOS and Android Chrome.

The 2024 version only targeted a hard-coded list of webmail and login sites. The new campaign collects any cookie.

Victimology fits Russian interests, with a focus on Ukraine and the US. Sekoia also found a far-right Czech party site compromised, which matches APT29’s history of targeting European political parties.

Mandiant documented that pattern in a 2024 WINELOADER phishing campaign against German parties.

Stolen cookies can let attackers reuse authenticated sessions and reach webmail without passwords. Sekoia is working with affected countries’ CERTs on victim identification and possible infrastructure disruption.

Defenders should patch iOS and Chrome and block the indicated domains. Google also recommends Lockdown Mode where updates are impossible.

Network teams should hunt for the starx-net, flux-telemetry and clouds-stacks domains and review any use of the Plerdy tracker.

IOCs

Note:IP addresses and domains are intentionally defanged (e.g.,[.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Stops Cyber threats before impact with 21 min faster MTTR. Integrate ANYRUN’s Sandbox in your SOC.