Suspected APT29 mobile attacks exploited patched iOS and Android flaws | Magica
Suspected APT29 campaign targeted unpatched phones through poisoned websites
Editorial Team
••📖7 min read
Sekoia uncovered mobile data-theft tools delivered through compromised websites, cloned portals and Plerdy's analytics tracker. The analyzed attacks used already-patched flaws, and the report does not establish how many phones were infected.
Sekoia linked the campaign to APT29 with moderate-to-high confidence; the attribution is an assessment.
A shared analytics script expanded exposure, but the report gives no confirmed count of infected phones.
All three analyzed exploit chains used already-patched vulnerabilities and did not work against fully updated devices.
Attackers used compromised websites, copies of legitimate portals and a poisoned analytics script to deliver tools designed to steal data from unpatched iPhones and Android phones, according to cybersecurity vendor Sekoia. Its Threat Detection & Research team uncovered the operation in mid-October 2026 and described it in a November 4 report.
The consequential feature was the combination of distribution and reuse: attackers could reach visitors through websites they trusted, then deploy exploit chains for vulnerabilities whose fixes already existed. These are watering-hole attacks: the malicious code waits on a website for a visitor it can exploit. Visiting an affected page was the entry point; the subsequent exploitation required no further interaction. These were “n-day” attacks against known flaws, rather than previously unknown zero-days.
Sekoia assessed with moderate-to-high confidence that APT29, or one of its subgroups, conducted the campaign. Also tracked as Midnight Blizzard and Cozy Bear, APT29 is an espionage group associated with Russia's Foreign Intelligence Service, the SVR. In a February 2024 advisory announcement, the US National Security Agency and partners described that association as almost certain. The announcement identified the actors' involvement in the SolarWinds software supply-chain compromise and their use of accounts and system-issued tokens to access and remain inside cloud environments. That record gives context to the suspected operator; it does not establish responsibility for this campaign.
Sekoia’s company-reported findings summarize the mobile attack pipeline and targeted data. Its APT29 attribution carries moderate-to-high confidence; the number of infected phones remains unknown. Source: Sekoia.
N-able says its latest N-central hotfix patches all identified vulnerabilities exploitable without authentication and hosted servers are back online. Further patches, customer-side upgrades and checks for compromise remain necessary after public exploit code prompted a precautionary shutdown.
Editorial Team
One shared script widened the attack surface
Sekoia's investigation began at a Ukrainian gas producer's website, where malicious JavaScript loaded an external device-profiling script. Other directly compromised sites included a US chemical-industry trade association, a Bulgarian military-related website and a far-right Czech political movement's site.
The attackers also operated lookalike domains that relayed content from real websites while inserting malicious code. One imitated America250, the initiative commemorating the 250th anniversary of US independence. Another copied Raffles London at The OWO, a luxury hotel near sensitive British government institutions. Sekoia suggested these could support invitation-themed or diplomatic targeting, but did not establish that such targeting occurred.
The broader distribution route was Plerdy, a Ukrainian web analytics service whose SEO tracking script was loaded by thousands of predominantly Ukrainian websites. Sekoia said attackers modified the tracker between August 27 and September 3, 2026, making it load their code alongside the legitimate analytics script. Sites using the tracker included military recruitment and defense-equipment websites.
There is a limit to that reconstruction: Sekoia could not retrieve the script from the analytics attack's delivery domain because it was offline. A matching filename underpinned its moderate-to-high-confidence assessment that the same fingerprinting script was involved.
This route exposed visitors through a shared component across otherwise separate sites. Sekoia's introduction describes hundreds of sites exposed, while its conclusion refers to expansion across thousands. The report supplies no reconciled count of affected sites, vulnerable visitors or successful infections; the tracker's installed reach cannot substitute for those measurements.
Nor is the intended selection clear. Sekoia could not determine whether the analytics compromise was aimed at particular sites' visitors or cast a wider net for credentials worth exploiting later. An Australian medical clinic among the directly compromised sites further complicated a single strategic explanation.
Different phones received different data-theft tools
The initial script, called UltimateFingerprinter by its operators, collected browser and device attributes before the server returned an exploit chain. Sekoia recovered three complete chains by testing browser profiles against the delivery infrastructure.
Delivery profile observed by Sekoia
Vulnerabilities used in the analyzed chain
Data targeted
iOS 16.7
CVE-2025-43529; CVE-2024-27834
Cookies, potentially including those stored by running applications beyond Safari
Messages, WhatsApp and Telegram databases, stored credentials, location information, health data, photos and other device data
Android Chrome versions 139–145, excluding 143
CVE-2026-3910; CVE-2025-27038
Chrome cookies, saved logins, browsing history and Wi-Fi passwords
These are observed delivery profiles, not a tested inventory of every vulnerable device. Sekoia said the cookie-stealing iOS chain should work across versions 16.0–17.4, even though the server selected iOS 16.7/16.7.10. It interpreted that mismatch as possible evidence of reused tools. The Android chain combined a Chrome vulnerability with an Adreno graphics-driver flaw, and its exploit stopped if it detected the Samsung Galaxy S25 Ultra model SM-S938B. Sekoia did not know why Chrome 143 was excluded.
The more extensive iOS chain used DarkSword, a reusable set of exploits for breaking into iPhones. This was already an established tool: Google's Threat Intelligence Group said in its March 18, 2026 analysis that it had observed commercial surveillance vendors and suspected state-sponsored actors using DarkSword since at least November 2025, including against targets in Ukraine. Shared tools therefore do not uniquely identify this campaign's operator.
Sekoia argues that packaged chains reduce the cost and technical threshold for mobile exploitation. Its report supplies no acquisition price or operating-cost comparison, and does not establish how these operators obtained their tools.
Successful cookie theft could let attackers reuse logged-in sessions, including access to webmail. The payloads established no persistence on the phones, according to Sekoia. That limits their foothold on the device, but does not undo data already stolen.
Google Threat Analysis Group’s company-reported timeline traces exploit reuse in earlier campaigns, including Mongolian watering holes in 2023–2024. It provides historical context, not proof of responsibility for the newly reported campaign. Source: Google Threat Analysis Group.
Attribution rests on overlaps, with targeting still unresolved
Sekoia's attribution combines technical similarities, infrastructure patterns and the affected websites' relevance to Russian interests. Sekoia said national response teams found traces of separate malicious activity in one compromised website's backend files; a partner said those traces matched a private report about a 2025 operation attributed to APT29. Sekoia considered both old artifacts left in place and components reused by the current operator as explanations. It also said Google's Threat Analysis Group confirmed similarities to an earlier mobile watering-hole framework.
The relevant precedent involved Mongolian government websites compromised between November 2023 and July 2024. Google's Threat Analysis Group linked those attacks to APT29 with moderate confidence. They too used already-patched mobile flaws, with exploits identical or similar to ones previously used by commercial surveillance vendors Intellexa and NSO Group. Google said it did not know how the attackers acquired them.
Sekoia said the earlier cookie-stealing framework restricted collection to specified websites, whereas the newly analyzed campaign collected cookies without that restriction and, in some cases, much more device data. That is a difference in collection scope, not evidence that every exposed visitor's data was taken.
Extensive device profiling does not settle the targeting question either. Sekoia found that most collected attributes did not affect exploit delivery: beyond operating-system and browser selection, it observed only basic checks for plausible phone dimensions and touch capability. It found no evidence that the remaining fingerprint data influenced delivery or was reused later in the infection chain.
Victim identification is the next test
Sekoia said it was working with national computer emergency response teams, including Ukraine's CERT-UA, to identify victims and assess ways to disrupt the infrastructure. Establishing which visitors were actually infected would distinguish potential reach from demonstrated intelligence collection and help resolve whether the analytics compromise supported selective targeting or broad harvesting.
Sekoia says all flaws used in the analyzed chains were fixed before the campaign began. Available operating-system, browser and device security updates address those exploit paths. What remains unresolved is which devices were infected and what data the operators obtained.
Vates has patched an exploited Xen Orchestra login bypass, while its November 10 advisory leaves a separate VM import flaw unfixed. Administrators must also review delegated permissions and investigate possible host compromise.
CISA has listed exploited flaws in Openwave’s webmail document converter and Cisco’s BroadWorks communications platform, setting a November 24 federal remediation deadline. Openwave dates its fix to 2021; a separate research account links Cisco’s flaw to theft of telecom authentication keys.
Maersk confirms data theft from an acquired legacy system and disputes WhiteArmor’s password claims. The group demands $5 million while Maersk says it has found no impact on wider systems and expects no customer disruption.
Binance warns that malicious iPhone apps could use worse_query to read other apps’ files. A file manager built on the public code demonstrates cross-app access, but no cryptocurrency losses have been confirmed and the latest Apple updates have not been linked conclusively to a fix.
Microsoft fixed an actively exploited Outlook flaw that can disclose authentication information when a user opens a malicious file. The moderate-rated bug warrants priority within a November release exceeding 1,000 vulnerabilities, but the attackers and scale of abuse remain undisclosed.
Vanderbilt University allowed students and employees to resume using university devices Tuesday after ordering a shutdown Monday. Key services were available, but wider restrictions persisted and attackers’ claims of extensive data theft remained unconfirmed.
Barracuda says exploitation of recently disclosed vulnerabilities has affected a small number of organizations. Patches are available, and the two-flaw chain can give attackers root access to Email Security Gateway appliances with reachable administrative interfaces.
SAP’s November release addresses four flaws rated 10.0, including ICM2SHELL and PROXYGATE. Customers face unauthenticated routes into core business systems, and Gateway remediation can require configuration changes alongside patches.
Compromised Qubole credentials let an attacker assume customer AWS roles, harvest secrets and download data in October. Dormant integrations extended the exposure, while gaps in storage logs complicated efforts to establish what was stolen.
Google has fixed an actively exploited XML vulnerability in its Chrome desktop browser. The update brings this year’s exploited zero-day tally to eight, while details of the attacks remain undisclosed.
N-able took hosted N-central offline and urged customers running their own servers to do the same after public exploit disclosures. The shutdown interrupts a platform used to manage customer networks, while the scope of the flaws and a safe restoration date remain unresolved.
Trump nominated Palantir security chief Michael LoSapio to lead CISA, where workforce losses and a proposed funding reduction complicate the job as Senate control is set to change.
Iris Plaza says an intrusion into an external cloud service may have exposed data on 5.8 million current and former members and 1.9 million non-members. Its official shopping site remains suspended, while the actual extent of any leak is still under investigation.
France attributes October attacks on roughly 700 retail sites to an Iranian Revolutionary Guard cyber unit. Fires and spoiled food have turned exposed refrigeration controls into a diplomatic and criminal case, while responsibility for later attacks remains unresolved.
Apple says three macOS updates stop bundled command-line tools from accepting compromised eMudhra certificates, extending protections already delivered to Safari and Mail. Apps with their own certificate lists still require separate checks.
Elliptic estimates that responders froze or seized 44% of the $6.43 billion stolen from Binance. Cross-chain services and screening gaps kept other funds moving, but most remaining value was still parked and little had likely been cashed out.
Researchers observed public proxy traffic exiting six addresses registered to the Executive Office of the President. The findings expose a possible route for outsiders to borrow government network identities, but do not establish access to internal systems.
Alpine Linux has patched a password-authentication bypass reachable through OpenSSH on systems using musl without PAM authentication. Under specific account and server settings, attackers can enter key-only accounts; some cloud instances can then give them root access.
Ryan James Roach has been extradited to face charges over alleged intrusions targeting US universities with supercomputers. Prosecutors allege credential theft and the diversion of university processing power for cryptocurrency mining; a second defendant remains in Canadian extradition proceedings.
