APT29 uses Plerdy supply chain to hit mobile devices with n-day exploits

1. Executive summary

Sekoia's Threat Detection & Research team reported in mid-October 2026 a watering-hole campaign it assesses with moderate to high confidence to be linked to APT29, which it ties to Russia's SVR. The operation used three delivery vectors (JavaScript injected into legitimate sites, lookalike domains, and a supply-chain compromise of the Ukrainian web analytics service Plerdy) to serve platform-specific n-day exploit chains to iOS and Android visitors without user interaction. The chains steal cookies, messages, Keychain passwords, saved logins, browsing history, Wi-Fi passwords, location and health data, and none of the payloads installs anything that persists after exfiltration. Every flaw in the three chains had been fixed before the campaign began, and Sekoia states that a user running an up-to-date operating system is safe from these attacks. For EMEA financial services the risk is concentrated in unmanaged or lagging mobile fleets and in staff who browse from personal devices: a patched device is not exposed, and the mitigations are version enforcement and session hygiene rather than network blocking.

2. Regulatory framing

3. Technical analysis & attack chain

Sekoia's investigation started with a malicious script on the website of a Ukrainian gas production company and expanded to other compromised sites: a US chemical industry trade association, a far-right European political party, a Bulgarian military-related organisation, and an Australian medical clinic. Sekoia assesses with low confidence that the clinic and similar low-value sites were used to target specific individuals. Two lookalike domains loaded the legitimate pages of America250 and of Raffles London at The OWO; Sekoia believes the hotel clone may have been aimed at diplomatic delegations and prominent guests, and cites open-source reporting that Ukrainian President Volodymyr Zelensky stayed there on 14 October. The widest-reach vector was Plerdy: between 27 August and 3 September 2026 the attackers served their code through its tracking script, which runs on thousands of websites, most of them Ukrainian, including sites run by the army, special forces and military equipment makers.

Confirmed delivery chain:

1. A victim visits a compromised legitimate site, a lookalike domain, or any site loading the Plerdy tracking script.
2. The injected code loads an external script that profiles the visitor's browser and device.
3. The delivery host reads the mobile OS and browser version and serves the matching n-day exploit chain, with no user interaction.
4. The chain runs and exfiltrates data. No payload persists on the device after the data is sent out.

The three chains:

• iOS 16.7: CVE-2025-43529 chained with CVE-2024-27834 to steal cookies, allowing reuse of logged-in sessions against services such as webmail.
• iOS 18.5: a chain built on the DarkSword exploit kit using CVE-2025-43529, CVE-2026-20700, CVE-2025-14174, CVE-2025-43510 and CVE-2025-43520. It takes SMS, iMessage, WhatsApp and Telegram data, Keychain passwords, location data, health information and photos.
• Android, Chrome versions 139 through 145 except 143: CVE-2026-3910 (a Chrome flaw) chained with CVE-2025-27038 (an Adreno graphics driver vulnerability) to grab Chrome cookies, saved logins, browsing history and Wi-Fi passwords.

Verified severity and exploitation state for the exploited CVEs, from NVD, EPSS and CISA KEV:

All eight CVEs are in CISA KEV except CVE-2024-27834. The KEV listing confirms in-the-wild exploitation independently of Sekoia. The source does not state which specific fixed OS or browser build closes each CVE; Sekoia's statement is that every flaw was fixed before the campaign began and that an up-to-date OS is safe.

Attribution: Sekoia assesses moderate to high confidence for the APT29 link, resting on traces of a 2025 APT29 watering-hole operation on one compromised site, similarities with a 2024 APT29 campaign against Mongolian government websites that Google's Threat Analysis Group confirmed, and a victim list centred on Ukraine. The actor is tracked in MITRE ATT&CK as G0016. The SVR link is reported by Help Net Security, not independently established here. This is a single-vendor attribution; treat it as unconfirmed pending corroboration.

Sekoia notes it remains unclear whether the attackers targeted visitors to specific sites or sought to compromise as many unpatched mobile devices as possible, exfiltrating indiscriminately before selecting what mattered. It also assesses that reuse of packaged n-day exploit frameworks such as DarkSword by state-sponsored groups will likely become more frequent.

4. Mitigation & containment

P1 (within 24 hours)

• Enforce a minimum mobile OS baseline that excludes iOS 16.7 and iOS 18.5 on managed iPhones, and a Chrome baseline above version 145 on managed Android devices. Sekoia states an up-to-date operating system is safe; the source does not name the specific fixed build for each CVE, so set the baseline to the current release and verify against the vendor.
• On unmanaged or BYOD devices used for corporate webmail, require the current OS and browser before allowing session access. The iOS 16.7 chain exists to steal cookies and reuse webmail sessions, so stale mobile sessions are the exposure.
• Invalidate active sessions and force re-authentication for any user confirmed to have visited the named compromised properties (the Ukrainian gas producer, the US chemical trade association, the far-right European political party, the Bulgarian military-related organisation, the Australian medical clinic, the America250 and Raffles London lookalikes) from a mobile device during the campaign window.

P2 (within 72 hours)

• Inventory every third-party script on public web properties, starting with analytics and tracking tags. The Plerdy compromise shows a supplier's script is a delivery path; require change notification and integrity monitoring from each provider.
• Add the lookalike domains for America250 and Raffles London at The OWO to web proxy and DNS blocklists once Sekoia or the relevant CERT publishes them. The source does not give the domain strings, so do not guess them.
• Review mobile device management coverage for staff who access corporate services from phones; devices outside MDM cannot be version-enforced and should be treated as the priority gap.

P3 (within 7 days)

• Brief staff who travel to diplomatic, defence-adjacent or Ukraine-related events that hotel and conference Wi-Fi and cloned hotel pages were used as lures, and that the payload needs no click.
• Track CERT-UA and Sekoia publications for the domain and script indicators as they are released; the source names no hashes, domains or script URLs.

5. Indicators of compromise

No atomic indicators (hashes, domains, IPs, script URLs) are given in the source. Sekoia names the delivery vectors and victim sectors but publishes no pivotable values in this reporting.

Behavioural indicators:

6. Detection

Insufficient indicators to author detection rules.

The source gives no file names, strings, command lines, registry keys, mutexes or network values to build a rule from. Detection should rest on the version baselines and third-party script monitoring in §4 until Sekoia or a CERT publishes technical indicators.

CVE assessment

8 referenced CVEs — 7 actively exploited (CISA KEV)

Threat actor context

APT29 · G0016 · aka IRON RITUAL, IRON HEMLOCK, NobleBaron, Dark Halo, NOBELIUM

APT29 is threat group that has been attributed to Russia's Foreign Intelligence Service (SVR). They have operated since at least 2008, often targeting government networks in Europe and NATO member countries, research institutes, and think tanks. APT29 reportedly compromised the Democratic National Committee starting in the summer of 2015. …

7. Sources

• Help Net Security, "Russian hackers target iOS and Android users with n-day exploits", https://www.helpnetsecurity.com/2026/11/04/apt29-watering-hole-mobile-devices-n-day-exploits/, 2026-11-04 (reporting Sekoia Threat Detection & Research findings).
• NVD, EPSS and CISA KEV entries for the eight CVEs listed in §3 (severity, exploitation state and EPSS values as recorded).
• MITRE ATT&CK, APT29 (G0016).

8. Adverse Trace position

Adverse Trace assesses this as a high-severity targeted campaign for organisations with unpatched mobile devices, and low severity for those that can enforce current iOS and Chrome versions. The exploitation is confirmed by CISA KEV for seven of the eight CVEs, but the attribution to APT29 is single-sourced to Sekoia at moderate to high confidence and should be treated as unconfirmed until corroborated. The absence of persistence means the window for detection is the exfiltration itself, so session and identity logs matter more than endpoint artefacts. We will monitor CERT-UA and Sekoia for published domain and script indicators, and will issue an update when atomic indicators or a named fixed build per CVE becomes available. Clients should confirm their mobile OS and browser baselines now and report any suspected session compromise through their DORA incident process.

Read the original source →

Published via PulseTrace — Adverse Trace threat intelligence.