Hackers assessed with moderate to high confidence as part of Russia's Foreign Intelligence Service exploited previously patched iOS and Android vulnerabilities to compromise visitors across hundreds of websites, according to security researchers at Sekoia.
The attacks deployed zero-click exploit chains triggered when users navigated to compromised sites. JavaScript injected into web traffic profiled each device, then delivered customized payloads designed to exfiltrate browser cookies, Wi-Fi passwords, and device data without user interaction.
One target was america250.org, operated by a non-partisan group preparing for the 250th anniversary of American independence. Attackers registered america250[.]holiday and operated it as a reverse proxy, serving legitimate content while embedding malicious JavaScript. Sekoia assessed the targeting reflected interest in a high-profile national event that could enable invitation-themed spear-phishing campaigns.
A second site, theowo[.]club, impersonated Raffles London at The OWO, a luxury hotel near sensitive UK government institutions including the Ministry of Defence and 10 Downing Street. Open-source reporting indicated Ukrainian President Volodymyr Zelenskyy stayed at the hotel on Oct. 14. Compromising the hotel property would position attackers to target diplomatic delegations and high-profile guests through focused spear-phishing.
The SVR deployed attacks through three infection vectors: direct JavaScript injection into traffic from legitimate websites, proxy domains such as america250[.]holiday, and compromise of a Ukrainian web analytics service. The analytics vendor supported thousands of websites, amplifying attack reach. Compromised legitimate properties included a major Ukrainian gas production company.
Sekoia attributed the campaign to the Kremlin based on targeted entities and similarities with a previous attack attributed to APT29, another designation for the suspected Russian group. In each vector, the injected JavaScript collected browser and device information before delivering tailored zero-click exploit chains.
