Do Son 
TL;DR
In mid-October 2026, cybersecurity researchers exposed a major APT29 watering hole campaign targeting mobile devices across Europe and the United States. The attackers compromised high-profile websites and hijacked a popular Ukrainian web analytics service to profile visitors. Consequently, the threat actors delivered zero-click browser and kernel exploits to harvest sensitive data from unpatched iOS and Android phones.
What Happened in the Watering Hole Operation
According to an investigation by Sekoia Threat Detection and Research, the attackers used three distinct infection pathways. “This campaign relies on three infection vectors: direct JavaScript injection on legitimate websites, Adversary-in-the-Middle-like domains, and the supply-chain compromise of the Ukrainian web analytics service,” Sekoia researchers reported. First, the operators injected malicious JavaScript code directly into the main templates of a Ukrainian gas production company, a major U.S. chemical trade association, a far-right Czech political party, and a Bulgarian military website.
When direct intrusion was not possible, the operators of this APT29 watering hole campaign set up deceptive reverse proxies. Specifically, they registered lookalike domains such as america250.holiday to mimic America250, the official initiative commemorating American independence. The attackers also created theowo.club, a proxy that mirrored the website of Raffles London at The OWO. This luxury hotel sits near 10 Downing Street and the British Ministry of Defence. Notably, Ukrainian President Volodymyr Zelensky stayed at the hotel on October 14, 2026, making it an attractive target for gathering diplomatic intelligence.
Furthermore, the threat group compromised the Ukrainian web analytics service Plerdy between August 27 and September 3, 2026. By modifying the legitimate tracker file on a.plerdy.com, the hackers exposed thousands of websites to malicious code. Many of these websites attract strategic visitors, including Ukrainian military units, special forces personnel, and drone manufacturers.
The UltimateFingerprinter Profiling Mechanism
All three infection routes delivered a custom JavaScript payload dubbed UltimateFingerprinter. The script was appended to a minified version of the AngularJS library, which accounted for 98% of the 2.3 MB file. This dead code helps the script evade detection and bypass automated analysis by large language models.
The profiling tool runs 61 distinct collectors to harvest 394 system attributes, including battery status, WebGL data, and audio capabilities. After assembling the profile, the script sends the data to static.flux-telemetry.com. Surprisingly, the delivery server ignores most of these technical fields. It only checks whether the screen dimensions match a phone and verifies that the screen supports touch input. If the visitor uses a standard desktop browser, the server returns an empty response.
Mobile Exploit Delivery and Payload Chains
When a mobile visitor matches the required profile, the server delivers one of three platform-specific exploit chains. Importantly, all three chains rely on patched n-day flaws rather than zero-day vulnerabilities. Users running updated operating systems remain completely safe from compromise.
The Class A exploit chain targets Apple devices running iOS 16.7. It delivers a JavaScript file that exploits CVE-2025-43529 for remote code execution and CVE-2024-27834 to bypass Pointer Authentication Codes. Once memory execution succeeds, the script sweeps through application containers to steal cookies from Safari and third-party apps before sending them to ad.starx-net.com.
The Class B chain delivers DarkSword, an exploit kit allegedly built by a commercial surveillance vendor. This chain targets iOS 18.5 through a multi-stage attack. First, it exploits CVE-2025-43529 and CVE-2026-20700 to execute code. Next, it breaks out of the browser sandbox using CVE-2025-14174 and CVE-2025-43510. Finally, it uses CVE-2025-43520 to gain kernel read and write privileges. A post-exploitation module then harvests SMS messages, iMessage databases, WhatsApp chats, Telegram records, Keychain credentials, photos, and location history.
Meanwhile, the Class C chain targets Android devices running Google Chrome versions 139 through 145, excluding version 143. The script exploits CVE-2026-3910 for browser execution and CVE-2025-27038 in the Qualcomm Adreno GPU driver to escape the sandbox. Interestingly, the code aborts if it detects a Samsung Galaxy S25 Ultra. Once running, it deploys a shared library called AndroSnitch to steal Chrome login data, stored cookies, browsing history, and saved Wi-Fi passwords.
Who Is Behind the Activity
Sekoia attributes this APT29 watering hole campaign to Russian state hackers with moderate to high confidence. Also known as Midnight Blizzard, Cozy Bear, and The Dukes, the group acts on behalf of Russia’s Foreign Intelligence Service (SVR).
Multiple forensic findings support this attribution. First, CERT partners discovered that backend files on one compromised website matched indicators from an earlier 2025 APT29 campaign. Second, Google Threat Analysis Group (TAG) confirmed that the delivery framework matches a 2024 APT29 watering hole campaign against Mongolian government websites. Third, the targeting aligns closely with Russian geopolitical goals, prioritizing Ukrainian military logistics, Western diplomatic venues, and European political parties.
Impact and Strategic Scale
The scale of this operation grew significantly during the one-week compromise of the Plerdy analytics platform. Because Plerdy is embedded across thousands of websites, the attackers gained access to an enormous pool of potential targets. “The adoption of packaged n-day exploit chains lowers the cost and technical threshold required to conduct advanced mobile exploitation,” Sekoia researchers observed.
Fortunately, the payloads do not install persistent rootkits on infected devices. Instead, the malware runs in temporary memory, exfiltrates targeted databases, and terminates. However, stolen authentication cookies and session tokens allow threat actors to access corporate cloud accounts long after the browser session closes.
How Organizations and Users Can Stay Protected
Because the APT29 watering hole campaign relies on known software vulnerabilities, applying operating system updates provides strong protection. Mobile users should update iOS and Android devices to the latest available software versions without delay. Furthermore, administrators must enable automatic app updates to ensure Google Chrome and WebKit engines receive security patches promptly.
Website administrators must also secure their third-party supply chains. Organizations should audit external scripts, analytics trackers, and advertising libraries loaded on their websites. Implementing Subresource Integrity (SRI) hashes prevents compromised external scripts from executing unauthorized code. In addition, website owners must enforce strict Content Security Policies (CSP) to restrict script execution to authorized domains. Finally, security operations teams should block communication with malicious delivery domains like static.flux-telemetry[.]com, ad.starx-net[.]com, and edge-ord.clouds-stacks[.]com.
Support Our Threat Intelligence
Find our threat intelligence and malware analysis helpful? Support our work today and unlock a 100% ad-free reading experience!
Buy Me a Coffee
