Russia's Foreign Intelligence Service exploited previously patched iOS and Android vulnerabilities this week, targeting visitors to multiple websites, according to cybersecurity firm Sekoia. The attacks used sophisticated zero-click exploit chains to compromise mobile devices without any user action.
The SVR, also known as APT29, injected JavaScript into web traffic to profile target devices and determine their platform. This profiling stage allowed attackers to deliver tailored payloads specific to each device.
Once compromised, the final payloads exfiltrated browser cookies, Wi-Fi passwords, and full device information—data valuable to both state intelligence and enterprise attackers.
One target was america250.org, a non-partisan website associated with the 250th anniversary of American independence, which includes lawmakers, business executives and at least one former member of President Trump's administration. Attackers registered a lookalike domain, america250[.]holiday, that functioned as a reverse proxy. The legitimate site's content passed through while malicious JavaScript was injected into traffic. Sekoia assessed the attackers chose this target deliberately to use the high-profile celebration as cover for invitation-themed spear-phishing.
The SVR also targeted the Raffles of London OWO luxury hotel through the proxy domain theowo[.]club. The hotel is physically located near critical United Kingdom government facilities, including the Ministry of Defence and 10 Downing Street. Open source reports indicate Ukrainian President Volodymyr Zelenskyy stayed there on Oct. 14. Sekoia said the targeting aimed to compromise diplomatic delegations and high-profile guests.
Beyond proxy domains, the campaign exploited compromised websites directly, including that of a major Ukrainian gas production company and a Ukrainian web analytics service with thousands of website clients. Across all three vectors, the initial injected JavaScript remained identical—a device profiling script delivered before the exploit payload.
Sekoia attributed the campaign to the Kremlin based on the specific profile of targeted organizations and individuals, and methodology consistent with previous APT29 operations tracked by multiple security agencies.
