Asl matn EN tilida, manba saytidan olindi. Manba ↗

A large-scale watering hole campaign that it assesses, with moderate to high confidence, is the work of APT29.

APT29 is also tracked as Midnight Blizzard, Cozy Bear and The Dukes, and is widely linked to Russia’s SVR foreign intelligence service.

The operation hit iOS and Android users through compromised sites, cloned domains, and a poisoned analytics service. It relied entirely on patched n-day flaws, so fully updated devices are not exposed.

The second was a set of adversary-in-the-middle-style reverse proxies. america250[.]holiday mirrors the America250 independence-anniversary site, and theowo[.]club mirrored Raffles London at The OWO, a hotel near the Ministry of Defence and 10 Downing Street.

Sekoia suspects the lures targeted diplomats and officials through spear-phishing.

The third vector was a supply-chain compromise of Ukraine’s Plerdy SEO Tracker. Between 27 August and 3 September 2026, attackers modified a.plerdy[.]com’s tracker file so every visitor also loaded their fingerprinting script.

Sites using the tracker included military and defence-equipment pages.

All three vectors load “UltimateFingerprinter,” a script hidden behind roughly 2.3 MB of dead AngularJS code. Sekoia suggests this padding may hinder LLM-based analysis.

.webp)

APT29 campaign (Source : Sekoia).

The script gathers 394 fields through 61 collectors and posts them to a server. That server returns an exploit only if basic checks pass, such as a plausible phone screen size and a non-zero touch-point count.

Sekoia saw no sign that the rest of the fingerprint affected delivery.

Chain A targets iOS 16.7 with CVE-2025-43529 and CVE-2024-27834, and steals cookies. Chain B targets iOS 18.5 and is the full DarkSword kit.

It adds CVE-2026-20700, CVE-2025-14174, CVE-2025-43510 and CVE-2025-43520, and harvests the entire device.

That includes messages, WhatsApp and Telegram databases, Keychain secrets, Wi-Fi passwords, location caches, photos and iCloud Drive.

Sekoia found the activity, the first vector was direct JavaScript injection into legitimate sites, including a Ukrainian gas producer, a US chemical-industry trade association, and a Bulgarian military-related site.

Chain C hits Android Chrome 139–145 (excluding 143) using CVE-2026-3910 and CVE-2025-27038, an Adreno GPU driver flaw.

Its final payload, which Sekoia dubbed AndroSnitch, exfiltrates Chrome cookies, saved logins, history and Wi-Fi configuration. All chains send data to ad.starx-net[.]com:8881/telemetry/v12 and establish no persistence.

Google’s threat intelligence group described DarkSword in March 2026 as an iOS chain supporting iOS 18.4–18.7. It uses six vulnerabilities, several of which were exploited as zero-days.

It has been adopted by commercial surveillance vendors and suspected state actors. Google noted that UNC6353, a suspected Russian espionage cluster, had added it to watering hole attacks on Ukrainian sites. Apple patched all the flaws by iOS 26.3.

Sekoia’s evidence includes a compromised site whose files matched a private report on a 2025 APT29 watering hole. Google TAG also confirmed the framework resembles APT29’s 2024 campaign against Mongolian government sites.

That campaign used n-day exploits identical or strikingly similar to those of NSO Group and Intellexa, and it stole cookies from iOS and Android Chrome.

The 2024 version only targeted a hard-coded list of webmail and login sites. The new campaign collects any cookie.

Victimology fits Russian interests, with a focus on Ukraine and the US. Sekoia also found a far-right Czech party site compromised, which matches APT29’s history of targeting European political parties.

Mandiant documented that pattern in a 2024 WINELOADER phishing campaign against German parties.

Stolen cookies can let attackers reuse authenticated sessions and reach webmail without passwords. Sekoia is working with affected countries’ CERTs on victim identification and possible infrastructure disruption.

Defenders should patch iOS and Chrome and block the indicated domains. Google also recommends Lockdown Mode where updates are impossible.

Network teams should hunt for the starx-net, flux-telemetry and clouds-stacks domains and review any use of the Plerdy tracker.

IOCs

DomainCreation dateMalicious delivery domain
theowo[.]club18/06/2026static.flux-telemetry[.]com
america250[.]holiday19/05/2026adsprism-stat[.]com

Note:IP addresses and domains are intentionally defanged (e.g.,[.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Stops Cyber threats before impact with 21 min faster MTTR. Integrate ANYRUN’s Sandbox in your SOC.