Hackers linked to Russia's Foreign Intelligence Service exploited previously patched iOS and Android vulnerabilities to compromise visitors of multiple websites, security researchers reported Wednesday.
The attackers targeted sites connected to the ongoing war in Ukraine. When iPhone or Android users navigated to one of potentially hundreds of affected websites, injected JavaScript profiled the visitor's device and deployed customized payloads designed to steal browser cookies, Wi-Fi passwords and mobile device data.
One target was america250.org, a non-partisan group preparing for the 250th anniversary of American independence. The attackers registered america250[.]holiday and used it as a reverse proxy, delivering content from the legitimate site while embedding malicious JavaScript. Security firm Sekoia said the attackers likely selected the site due to its association with the high-profile national celebration, potentially using the event as a pretext for invitation-themed spear-phishing.
A second target was theowo[.]club, which proxied the website for Raffles London OWO, a luxury hotel near sensitive UK government institutions including the Ministry of Defence and 10 Downing Street. Ukrainian President Volodymyr Zelenskyy stayed at the hotel on Oct. 14, according to open-source reports. Sekoia researchers suggested the attackers aimed to target diplomatic delegations and high-profile guests through spear-phishing campaigns.
The attackers also compromised legitimate websites to launch operations, including a major Ukrainian gas production company and a Ukrainian web analytics service that supports thousands of websites.
Sekoia attributed the attacks to the Kremlin based on the target profiles and similarities to a previous campaign attributed to APT29, a name used to track the suspected Russian intelligence operation.
The hackers employed three primary infection vectors: direct JavaScript injection into traffic from legitimate websites, proxy domains such as america250[.]holiday, and a supply-chain compromise of the Ukrainian web analytics service. During the initial stage, the injected JavaScript gathered information about the visitor's browser and device. The attackers then deployed one of three zero-click exploit chains, which functioned without requiring any interaction from the target device or user.
