Hackers assessed with moderate to high confidence as part of Russia's Foreign Intelligence Service exploited previously patched iOS and Android vulnerabilities to compromise visitors to multiple websites. The attacks began when iPhone or Android users visited one of hundreds of sites, with JavaScript injected into traffic to profile devices.
The final payloads, tailored to each mobile platform, aimed to steal browser cookies, Wi-Fi passwords and full device data. Security firm Sekoia reported its findings Wednesday.
One target was a site impersonating america250.org, a non-partisan group involved in planning America's 250th anniversary celebration. The attackers registered america250[.]holiday and used it as a reverse proxy, serving content from the legitimate site while embedding malicious JavaScript.
Sekoia researchers said the group likely selected america250.org to leverage the high-profile national event as a pretext for invitation-themed spear-phishing campaigns.
Another impersonated site was theowo[.]club, which proxied Raffles London OWO, a luxury hotel located near sensitive UK government institutions, including the Ministry of Defence and 10 Downing Street. Ukrainian President Volodymyr Zelenskyy stayed at Raffles London OWO on October 14 during a visit. By impersonating the hotel, the intrusion set may have sought to target diplomatic delegations and high-profile guests through spear-phishing.
The attackers also delivered exploits through compromised websites, including a major Ukrainian gas production company and a Ukrainian web analytics service that supports thousands of websites.
Sekoia attributed the activity to Russian state actors based on target profiles and similarities to APT29, a group suspected of Russian state links.
The intrusion relied on three infection vectors: direct JavaScript injection into traffic from legitimate websites, proxy domains such as america250[.]holiday, and a supply-chain compromise of the Ukrainian web analytics service.
In each case, injected JavaScript profiled the visitor's browser and device, allowing attackers to deliver zero-click exploit chains that activate without requiring user interaction.
