APT29’s Watering Holes Target Thousands of Mobile Users

After compromising websites, the Russian state-sponsored threat group is fingerprinting victims, then harvesting information from the interesting ones.

It has emerged this week that Russia’s APT29 threat group compromised the website of a Ukrainian SEO and website analytics service, and briefly used the access to distribute malicious device-fingerprinting code to potentially thousands of iPhone and Android users.

The weeklong compromise earlier this year was part of a broader watering-hole campaign from APT29 (aka Cozy Bear, Midnight Blizzard, and The Dukes) that also used other legitimate and fake websites to distribute the fingerprinting malware, and later to collect sensitive personal information from selected devices.

No Clear Cyberattack Targeting, Beyond Android & iPhone Users

Researchers at Sekoia who are tracking the campaign are unsure if the state-sponsored advanced persistent threat (APT) had specific targets in mind, or if it was simply trying to infect as many vulnerable phones as possible.

“Across the directly compromised websites, no single sectoral targeting pattern emerges from our analysis,” Sekoia’s threat research and intelligence team wrote. “While the victimology shows a focus on Ukraine and the United States, the inclusion of unrelated entities such as an Australian medical clinic complicates a broad strategic interpretation.”

APT29 is a familiar threat actor that the US government has formally tied to Russia’s Foreign Intelligence Service (SVR). Its primary mission is intelligence gathering on behalf of Moscow, with a focus on government agencies, diplomatic organizations, think tanks, technology companies, healthcare, and research institutions.

Among its most prominent campaigns were the breaches at the Democratic National Committee in 2016, efforts to steal COVID-19 vaccine research in 2020, and the SolarWinds supply-chain compromise, which gave it access to numerous US government agencies and private-sector organizations. The group is known for stealthy, long-term intrusions, and in recent years has increasingly targeted cloud environments, email accounts, and technology providers to gain access to downstream victims.

3 Different APT29 Infection Vectors

In its latest campaign, APT29 used three separate infection vectors to target iOS and Android devices. One involved compromising legitimate websites and injecting malicious JavaScript that exposed visitors to a device-fingerprinting script. Among the websites the threat actor turned into watering holes were those of a US chemical-industry trade association, a Ukrainian gas producer, and a Bulgarian military-related organization.

When unable to compromise a legitimate website, the group created lookalike domains that impersonated the real sites, and modified their content in real-time to inject the malicious code. Two examples it impersonated were the America250 national celebration website and London’s Raffles hotel.

The third vector involved a supply chain compromise of Ukrainian website analytics firm Plerdy. According to Sekoia, thousands of websites, most of them Ukrainian, use the company’s tracking scripts. By injecting malicious code into that script, APT29 potentially exposed visitors to those sites to its device-fingerprinting and exploit-delivery infrastructure, Sekoia said.

The fingerprinting malware collected device and browser data from Android and iOS devices and sent it to an APT29 command-and-control service, which then delivered one of three different exploit chains depending on the mobile platform and browser/OS versions. Each chain targeted specific vulnerabilities in iOS or Android that had remained unpatched on the exposed devices.

Different Attack Chains for Different Devices

On vulnerable iOS 16.7 devices, APT29’s exploit chain took advantage of CVE-2025-43529 (a vulnerability that the DarkSword exploit kit abused previously) and CVE-2024-27834 to steal iOS browser cookies. On devices running iOS 18.5, the threat group delivered the full DarkSword exploit chain, involving five different vulnerabilities, to exfiltrate a wide range of data from compromised devices. Data the payload could collect included SMS and iMessages, voicemail, WhatsApp and Telegram messages, stored passwords and authentication tokens, account credentials, call history, contacts, calendar entries, notes, photos, and other sensitive information.

Sekoia said it found several indicators linking the campaign to APT29, including remnants of a separate 2025 watering-hole operation that researchers have previously attributed to the group. Sekoia also found signs that the attackers may have obtained their exploits from a third party, possibly a commercial surveillance vendor (CSV). The campaign’s victims include organizations in Europe and the US, though most are based in Ukraine, a country that Russian threat groups have incessantly targeted since the beginning of the war in Ukraine.

APT29’s latest campaign is another indication of how mobile devices have become attractive intelligence targets for threat groups. Commercial spyware vendors are fueling the trend by making technology available that enables large scale surveillance and data theft via mobile devices. APT29’s likely sourcing of the DarkSword exploit kit from a third-party provider suggests that sophisticated mobile intrusion capabilities that were once largely associated with highly targeted espionage operations are finding their way into broader campaigns.

“The adoption of packaged n-day exploit chains lowers the cost and technical threshold required to conduct advanced mobile exploitation,” Sekoia warned. “Over the long term, we assess that the proliferation and reuse of CSV exploits among state-sponsored intrusion sets will likely become more frequent.”