Russian Foreign Intelligence Service hackers exploited previously patched iOS and Android vulnerabilities to compromise visitors across multiple websites, including one tied to America's 250th anniversary celebration, according to researchers at Sekoia.
The attack chain began when iPhone or Android users navigated to one of potentially hundreds of compromised or spoofed sites. JavaScript injected into traffic profiled each visitor's device and browser configuration, then delivered platform-specific payloads designed to steal browser cookies, Wi-Fi passwords, and full device data.
One target was america250.org, operated by a non-partisan group of lawmakers and business executives. Attackers registered america250.holiday and used it as a reverse proxy, serving legitimate content while embedding malicious JavaScript. Sekoia assessed this choice was deliberate—the high-profile national celebration provided cover for spear-phishing campaigns.
A second target involved theowo.club, which proxied Raffles London OWO, a luxury hotel located near the UK Ministry of Defence and 10 Downing Street. Ukrainian President Volodymyr Zelenskyy stayed there during an October 14 visit. Sekoia determined the hotel impersonation aimed to target diplomatic delegations and high-profile guests.
The attackers also compromised legitimate websites directly, including a leading Ukrainian gas production company and a Ukrainian web analytics service serving thousands of sites, both leveraged as additional infection vectors.
Sekoia attributed the campaign to APT29, a tracked name for a suspected Russian intelligence group, based on targeting patterns and similarities to prior APT29 operations.
The hackers used three distinct delivery methods: direct JavaScript injection into legitimate website traffic, proxy domains like america250.holiday, and supply-chain compromise of the Ukrainian analytics service. In all cases, identical injected JavaScript performed initial profiling before deploying one of three zero-click exploit chains—requiring no user interaction to activate.
