APT29 watering holes and Plerdy supply-chain compromise target mobile devices

1. Executive summary

Sekoia's Threat Detection & Research team reports a watering hole campaign active in mid-October 2026 that compromised or cloned websites in the US, Ukraine, Czech Republic and Bulgaria, and separately compromised the Ukrainian web analytics service Plerdy between 27 August and 3 September 2026, exposing visitors of thousands of predominantly Ukrainian websites to an exploit kit. All three delivery vectors (direct JavaScript injection, reverse-proxy lookalike domains, and the Plerdy supply-chain compromise) load a fingerprinting script that serves n-day exploit chains for iOS and Android without user interaction, ending in cookie theft or full device data exfiltration. Sekoia assesses with moderate to high confidence that the campaign was conducted by APT29, a Russian nexus intrusion set it attributes to the SVR; that attribution is single-sourced and unconfirmed by any other reporting here. No CVE in this campaign has a verified NVD score, EPSS value or CISA KEV entry in the data available to Adverse Trace, and Sekoia states every exploit targets an already-patched flaw, so a fully updated device is not exposed. The risk to EMEA financial services is concentrated in unmanaged or lagging mobile fleets, particularly executive and diplomatic-facing staff whose devices hold session cookies, messaging databases and stored credentials.

2. Regulatory framing

3. Technical analysis & attack chain

Sekoia identified three infection vectors that all deliver the same fingerprinting payload, which then serves platform-specific n-day exploit chains. The confirmed steps, as Sekoia describes them:

1. A victim visits a compromised legitimate website, a lookalike reverse-proxy domain, or any site loading the compromised Plerdy tracker.
2. Injected JavaScript loads the UltimateFingerprinter script from an attacker-controlled host (for example static.flux-telemetry[.]com or edge-ord.clouds-stacks[.]com) as 5b4c8fea5cbcee273e8d830f52-temfp.js.
3. The script collects device and browser data from 61 collectors building 394 JSON fields and POSTs it to a nonce-bearing endpoint (for example hxxps://static.flux-telemetry.com/api/uGmlx2pmMHU1jq7wZU2QWgeC28vbXalf/v1).
4. The endpoint returns JavaScript exploit code matched to the device's OS and browser version.
5. The exploit chain runs without user interaction and delivers a final payload that exfiltrates data to hxxps://ad.starx-net[.]com:8881/telemetry/v12.

Direct website compromise. On a Ukrainian gas production company, the intrusion set injected a script into the site's main template that appends a script element loading the fingerprinter. On other sites it appended the malicious code to an existing legitimate JavaScript file, for example a tampered library on a Bulgarian military-related website. Other named victims include a major US chemical industry trade association and a far-right European political party.

Reverse-proxy lookalike domains. Where the operators could not compromise a legitimate site, they registered lookalike domains and patched HTML on the fly to inject the script at the bottom of each page. Sekoia names america250[.]holiday (reverse-proxying america250.org) and theowo[.]club (reverse-proxying the Raffles London at The OWO hotel site, now offline).

Plerdy supply chain. Between 27 August and 3 September 2026 the operators injected code into the legitimate hxxps://a.plerdy[.]com/public/js/click/main.js tracker file, so visitors loaded both the real Plerdy script and the fingerprinter. The injected script pointed at edge-ord.clouds-stacks[.]com, which Sekoia could not retrieve; it assesses with moderate-to-high confidence the file was the same fingerprinter based on the identical filename. That host redirected via HTTP to other delivery servers including ads-it-assets[.]com, cdn.adv-static[.]com, wpvortex-mod[.]com and assets-int[.]com.

Fingerprinting script. The UltimateFingerprinter is a custom JavaScript payload appended to a minified AngularJS library that makes up roughly 98% of the 2.3 MB file. Sekoia believes the padding is intended to hinder automated analysis or make the script look legitimate. Despite 394 collected fields, only three gate delivery: screen width and height (implausible values such as 99999 block delivery) and navigator.maxTouchPoints set to 0. When the gate fails the server returns 200 OK with an empty body.

Exploit chains. Sekoia retrieved three complete chains, all built on known, already-patched vulnerabilities. None contains a zero-day and none works against a fully updated device.

Class A (iOS 16.7, chain works from 16.0 to 17.4) steals cookies. It sets a marker cookie VDGH_TOKEN_REF with a hardcoded value as a replay guard, though a day/minute error makes it expire in one minute. Stage 1 is an RCE using CVE-2025-43529, the same flaw as in the DarkSword kit but reimplemented; CVE-2024-27808 and CVE-2024-27833 remain as dead code. Stage 2 is a PAC bypass using CVE-2024-27834. Stage 3 reads Cookies.binarycookies from /private/var/mobile/Containers/Data/Application/<UUID>/Library/Cookies/ and POSTs a JSON body with category only_cookies to ad.starx-net[.]com:8881/telemetry/v12.

Class B (full data exfiltration) is the DarkSword chain. Stage 1 (/v1) uses CVE-2025-43529 for RCE and CVE-2026-20700 as PAC bypass. Stage 2 (/v2) escapes the sandbox with CVE-2025-14174 and CVE-2025-43510. Stage 3 (/v3) uses CVE-2025-43520 for kernel read/write, then a harvester pulls SMS and iMessage from sms.db, Mail indexes, Voicemail, WhatsApp and Telegram databases, Keychain passwords and tokens, Accounts3.sqlite, Wi-Fi PSKs from wifi_passwords.txt, contacts, call history, Calendar, Notes, Safari History.db and cookies, location caches, Health data, the photo library and iCloud Drive. CVE-2025-31277 and CVE-2025-24201 are present as alternates but not used in this delivery.

Class C (Android) targets unpatched Chrome versions 139.0.0.0 through 145.0.0, excluding 143. Stage 1 exploits CVE-2026-3910 for renderer code execution. Stage 2 loads shellcode exploiting CVE-2025-27038 in the Adreno driver to escape the sandbox; exploitation stops if the device is an SM-S938B (Samsung Galaxy S25 Ultra). Stage 3 is a payload Sekoia calls AndroSnitch, a shared library named libexploit.so with 16 functions that collects /data/data/com.android.chrome/app_chrome/Default/Cookies, Login Data, History, /data/misc/apexdata/com.android.wifi/WifiConfigStore.xml and /data/misc/apns/0/WifiConfigStore.xml, then exfiltrates via libcurl with Filename and X-Device-Id headers to the same telemetry endpoint. No persistence is established by any chain.

Attribution and confidence. Sekoia assesses with moderate to high confidence that APT29 conducted the campaign, citing technical overlaps, victimology focused on Ukraine and the US, distributed hosting, and a Czech political party compromise. Google TAG told Sekoia the framework resembles a 2024 APT29 watering hole against Mongolian government sites. The attribution rests on Sekoia's analysis and partner input; it is single-sourced in the material available here and is not corroborated by a second independent report. Sekoia also notes the victimology includes an Australian medical clinic, which it says complicates a broad strategic interpretation, and that the purpose of the extensive fingerprint remains unclear.

4. Mitigation & containment

P1 within 24 hours

• Patch iOS devices to a release that closes CVE-2025-43529, CVE-2024-27834, CVE-2026-20700, CVE-2025-14174, CVE-2025-43510 and CVE-2025-43520. Sekoia states every flaw was resolved by the vendor before the campaign began; it does not name the fixed versions, so confirm the closing release against Apple's advisories.
• Update Chrome on Android beyond 145.0.0 to close CVE-2026-3910 and CVE-2025-27038. Sekoia gives the affected range as 139.0.0.0 through 145.0.0.
• Block the delivery and exfiltration hosts at web proxy and DNS: static.flux-telemetry[.]com, edge-ord.clouds-stacks[.]com, ads-it-assets[.]com, cdn.adv-static[.]com, wpvortex-mod[.]com, assets-int[.]com, ad.starx-net[.]com, america250[.]holiday, theowo[.]club.
• Hunt proxy and DNS logs for requests to ad.starx-net[.]com:8881/telemetry/v12 and for the fingerprinter filename 5b4c8fea5cbcee273e8d830f52-temfp.js.

P2 within 72 hours

• Inventory any web property or intranet that loads a.plerdy[.]com and remove or pin the script until Plerdy confirms remediation. Sekoia gives the compromise window as 27 August to 3 September 2026.
• Review mobile device management coverage for executive, diplomatic-facing and travel staff; devices outside MDM cannot be confirmed patched.
• Treat any device that loaded an affected page during the campaign window as potentially compromised: rotate session cookies, stored passwords and tokens, and Wi-Fi credentials held on the device.

P3 within 7 days

• Add third-party script inventory and integrity monitoring to the web supply chain, covering analytics and SEO trackers loaded by customer-facing sites.
• Brief staff who travel to diplomatic or high-profile events on the reverse-proxy vector, since Sekoia assesses the Raffles London lookalike may have targeted delegations and guests.

5. Indicators of compromise

Sekoia withheld several indicators, including delivery hosts, exfiltration hosts and YARA rules, and offers them to CERTs and LEAs under . The values below are those published in the report.

domain  static.flux-telemetry[.]com
ipv4  109.104.106[.]107
domain  edge-ord.clouds-stacks[.]com
domain  ads-it-assets[.]com
domain  cdn.adv-static[.]com
domain  wpvortex-mod[.]com
domain  assets-int[.]com
domain  ad.starx-net[.]com
domain  america250[.]holiday
domain  theowo[.]club
url  hxxps://static.flux-telemetry[.]com/module/5b4c8fea5cbcee273e8d830f52-temfp.js
url  hxxps://edge-ord.clouds-stacks[.]com/module/5b4c8fea5cbcee273e8d830f52-temfp.js
url  hxxps://a.plerdy[.]com/public/js/click/main.js
url  hxxps://ad.starx-net[.]com:8881/telemetry/v12
url  hxxps://ad.starx-net[.]com/api/<NONCE>/v1
filename  5b4c8fea5cbcee273e8d830f52-temfp.js
filename  libexploit.so
cookie  VDGH_TOKEN_REF

Behavioural indicators

6. Detection

rule JS_UltimateFingerprinter_APT29_WateringHole
{
    meta:
        author = "Adverse Trace"
        date = "2026-11-04"
        reference = "https://www.sekoia.com/blog/poisoned-source-apt29-watering-holes-targets-mobile-devices-with-n-day-exploits"
        description = "Detects the UltimateFingerprinter JavaScript loader and injected Plerdy tracker code"
    strings:
        $fn = "5b4c8fea5cbcee273e8d830f52-temfp.js" ascii wide
        $host1 = "static.flux-telemetry.com" ascii wide
        $host2 = "edge-ord.clouds-stacks.com" ascii wide
        $api = "/api/uGmlx2pmMHU1jq7wZU2QWgeC28vbXalf/v1" ascii wide
        $cookie = "VDGH_TOKEN_REF" ascii wide
        $cat = "only_cookies" ascii wide
    condition:
        uint32(0) != 0x464C457F and
        2 of them
}

title: APT29 Watering Hole Fingerprinter and Telemetry Beacon
id: 8f2c1d4a-at29-4b7e-9c11-20261104aa
status: experimental
author: Adverse Trace
date: 2026/11/04
references:

  - https://www.sekoia.com/blog/poisoned-source-apt29-watering-holes-targets-mobile-devices-with-n-day-exploits
logsource:
  category: proxy
detection:
  selection_host:
    cs-host|endswith:

      - 'static.flux-telemetry.com'
      - 'edge-ord.clouds-stacks.com'
      - 'ad.starx-net.com'
      - 'ads-it-assets.com'
      - 'cdn.adv-static.com'
      - 'wpvortex-mod.com'
      - 'assets-int.com'
      - 'america250.holiday'
      - 'theowo.club'
  selection_uri:
    cs-uri|contains:

      - '5b4c8fea5cbcee273e8d830f52-temfp.js'
      - '/telemetry/v12'
  condition: selection_host or selection_uri
fields:

  - c-ip
  - cs-host
  - cs-uri
falsepositives:

  - None expected for the named hosts
level: high

Threat actor context

APT29 · G0016 · aka IRON RITUAL, IRON HEMLOCK, NobleBaron, Dark Halo, NOBELIUM

APT29 is threat group that has been attributed to Russia's Foreign Intelligence Service (SVR). They have operated since at least 2008, often targeting government networks in Europe and NATO member countries, research institutes, and think tanks. APT29 reportedly compromised the Democratic National Committee starting in the summer of 2015. …

7. Sources

• Sekoia TDR, "Poisoned Source: APT29 Watering Holes Targets Mobile Devices", 2026-10-29. https://www.sekoia.com/blog/poisoned-source-apt29-watering-holes-targets-mobile-devices-with-n-day-exploits

8. Adverse Trace position

Adverse Trace assesses this as a high-severity campaign for organisations with unmanaged or lagging mobile fleets, and low severity for organisations that can confirm current iOS and Android Chrome patch levels, because Sekoia states every exploit is an n-day against an already-patched flaw. The APT29 attribution is single-sourced to Sekoia and rests on technical overlap and victimology; we treat it as unconfirmed and will not attribute further activity to APT29 on this basis alone. No CVE in the campaign carries a verified NVD score, EPSS value or CISA KEV entry in the data we hold, so we have not assigned severity to individual flaws. We will monitor for vendor advisories naming fixed versions for CVE-2025-43529, CVE-2024-27834, CVE-2026-20700, CVE-2025-14174, CVE-2025-43510, CVE-2025-43520, CVE-2026-3910 and CVE-2025-27038, and will update this advisory if Sekoia releases the withheld delivery and exfiltration indicators. Clients should confirm mobile patch compliance and third-party script inventory first; those two controls close the exposure this campaign relies on.

Read the original source →

Published via PulseTrace — Adverse Trace threat intelligence.