Russia-Linked APT29 Targets iPhones, Androids in Watering Hole Campaign

· Cybersecurity · Ukraine · United States

Researchers say the Russia-linked threat group APT29 is behind a large-scale watering hole campaign that has targeted iPhone and Android users in Ukraine, the United States and Europe, with Ukraine the main focus. The attackers compromise websites and inject JavaScript that fingerprints each visitor before deciding whether to serve exploit chains, so only selected victims receive the malicious payload. The operation also uses fake domains and a supply chain compromise of a Ukrainian web analytics service, Plerdy SEO Tracker, to spread the injected code. The campaign aims to steal sensitive information from the devices of victims deemed interesting to the group. APT29 is a state-sponsored actor long tracked by Western agencies, and the report shows it extending espionage tradecraft from desktop targets to mobile devices on a broad scale.

Why it matters：State-sponsored espionage campaigns shifting to mobile watering holes put every organization with traveling or Ukraine-facing staff at risk, and show that compromised third-party analytics scripts remain an effective intrusion vector.

Key points

  • APT29 fingerprints visitors after compromising websites, then harvests data only from the most interesting victims
  • The campaign uses fake domains and a supply chain compromise of the Ukrainian analytics service Plerdy SEO Tracker
  • Targets are mainly in Ukraine, with additional victims in the US and Europe

Sources (original reporting)

More stories from this day