Adversary Intelligence — 2026-11-06

APT29 Launches Zero-Click Watering Hole Campaign Targeting iPhones and Android Devices in US, Ukraine, Czech Republic, and Bulgaria

BLUFUnpatched mobile devices visiting compromised Ukrainian and allied government-adjacent websites are now passive collection platforms for Russian intelligence, and stolen session cookies may already grant access that patching cannot revoke.

Sekoia's Threat Detection & Research team reported discovering, in mid-October, a watering hole campaign using compromised sites, lookalike domains, and a hijacked Ukrainian analytics service against sites in the US, Ukraine, the Czech Republic, and Bulgaria 12. Sekoia said the Plerdy tracker was compromised from August 27 to September 3, and that visitors received n-day exploit chains, including DarkSword for iOS, requiring no user interaction 1. Sekoia attributed the activity to APT29 with moderate to high confidence, citing overlaps with a 2024 campaign, and said the chains do not persist and fail against fully updated devices 12. Cyber Security News reported that stolen data goes to ad.starx-net[.]com and that Google recommends Lockdown Mode where updates are not possible 2.

Analysis
Defenders of Ukrainian, US, Czech and Bulgarian targets should treat unpatched phones as an open collection channel for Russian intelligence, since APT29 reused leaked commercial exploit kits that need no user action. The Plerdy compromise exposed hundreds of sites for a week, and collection of cookies and device data ran without a target filter. Stolen session cookies can open webmail without passwords, so patching does not close exposure from sessions already taken. Because the chains leave no persistence, victim identification depends on network logs and the indicators Sekoia is sharing with national CERTs. Confidence is high, based on a detailed primary Sekoia report that three outlets repeat without independent collection, with attribution resting on infrastructure and tooling overlaps. Another Russian-nexus or commercial-vendor-linked actor reusing the same kits could explain the campaign.

4 sources

APT29 watering holes target mobile devices with n-day exploits - Sekoia
APT29 Hackers Poison Websites to Target iPhones and Android Phones Without Users Clicking Anything - Cyber Security News
Russian hackers target iOS and Android users with n-day exploits - Help Net Security
Russia-Linked Hackers Hit iOS, Android Devices With Exploit Chains via Watering Holes - SecurityWeek