Hackers assessed with moderate to high confidence as part of Russia's Foreign Intelligence Service exploited previously patched iOS and Android flaws to compromise visitors of multiple websites, security firm Sekoia reported Wednesday. The attacks began when users accessed one of hundreds of sites, leading to device profiling and data exfiltration.
The intrusion set, tracked as APT29, employed JavaScript injected into website traffic to initiate the attacks. This first stage profiled the visitor's browser and device, then delivered one of three zero-click exploit chains, which activate without requiring any user interaction.
The final payloads aimed to steal browser cookies, Wi-Fi passwords and full mobile device data. This information enables further intelligence operations or financial exploitation.
One target was america250.org, a non-partisan group celebrating the 250th anniversary of American independence. Attackers registered america250.holiday and used it as a reverse proxy, delivering legitimate content while embedding malicious JavaScript.
A second target involved theowo.club, which proxied Raffles London OWO, a luxury hotel near the Ministry of Defence and 10 Downing Street. Ukrainian President Volodymyr Zelenskyy stayed at the hotel on Oct. 14. Researchers concluded that impersonating the hotel aimed to target diplomatic delegations and high-profile guests through spear-phishing campaigns.
The most significant vector was a compromised Ukrainian web analytics service with thousands of client websites. This supply-chain attack multiplied potential impact across a vast network of targets, including a top Ukrainian gas production company.
The use of previously patched vulnerabilities exposes a persistent enterprise cost: patch management across heterogeneous mobile device fleets remains incomplete despite years of security investment. The sophistication of zero-click exploits demands advanced, costly defenses that governments and high-value corporate targets can ill afford to skip.
Sekoia based its APT29 attribution on target profiles and similarities to previous Kremlin-backed operations. The incident underscores why enterprises must vet third-party service providers—analytics platforms, CDNs, tracking services—as potential vectors for state-sponsored intrusion. The economic impact extends beyond data loss to reputational damage and the substantial costs of incident response, forensic analysis and remediation.
