Researchers assess iOS and Android campaign as APT29 tied to Russia’s SVR

Researchers at Sekoia identified a watering hole campaign, in which attackers compromise websites their targets visit, in mid-October 2026 targeting iPhone and Android users, with the victim list centered on Ukraine, and they assess with moderate to high confidence that the intrusion set is APT29, also tracked under the names Midnight Blizzard and Cozy Bear, a group tied to Russia’s Foreign Intelligence Service, the SVR. The firm published research on the campaign on November 4, 2026.

The campaign began when visitors opened iPhone or Android sites drawn from potentially hundreds of compromised pages. It used JavaScript code injected directly into legitimate websites to profile each device by examining its traffic. Every delivery route ran a script that inspected the visitor’s browser and device before serving a platform-specific exploit chain needing no action from the user, and once the data had been sent the payloads left nothing behind on the device.

Attackers used CVE-2025-43529 and CVE-2024-27834 together against iPhones on iOS 16.7 to steal cookies, which could allow them to use those sessions to access services such as webmail. On iOS 18.5 devices they ran a DarkSword-based chain (DarkSword is a packaged mobile exploit framework) to pull almost everything stored on the phone, gathering messages, passwords, location data, health records and photos. Researchers suspect a commercial surveillance vendor built DarkSword.

The attackers targeted Android phones running Chrome from version 139 through 145, skipping 143, with CVE-2026-3910 in Chrome and CVE-2025-27038, an Adreno graphics driver flaw. The chain gathered Wi-Fi passwords, browsing history, saved login credentials and cookies stored in Chrome.

The campaign’s three exploit chains all relied on flaws vendors had patched before it began, so every exploit was an n-day flaw, meaning a vulnerability already disclosed and fixed. Researchers did not disclose how many devices attackers compromised.

Attackers compromised Plerdy, a Ukrainian website analytics tracker, between August 27 and September 3, 2026. The tracker operates on thousands of mostly Ukrainian sites, including those run by the army, special forces and military equipment makers, and hundreds of websites and the people visiting them faced the exploit kit during that August 27 to September 3, 2026 window. The group also relied on Adversary-in-the-Middle-like domains, which sit between users and websites, alongside this supply-chain compromise.

The list of hacked sites covered a Ukrainian gas producer, a US chemical industry trade group, a Czech far-right movement and a Bulgarian military-linked organization, and many probably drew strategically valuable visitors because of the Russia-Ukraine war. Attackers created america250[.]holiday to serve america250.org’s content with malicious JavaScript added.

Researchers assessed that the group may have selected america250.org as a spear-phishing pretext because of its link to a major national celebration, and a non-partisan group of lawmakers, business executives and a former Trump administration official is behind the real site. “We assess that the intrusion set may have deliberately selected this website,” researchers from security firm Sekoia said.

The lookalike domain theowo[.]club proxied Raffles London at The OWO, which is a luxury hotel near the UK Ministry of Defence and 10 Downing Street. According to Sekoia researchers, attackers intended the fake hotel site for diplomatic delegations and prominent guests. Open-source reports say the hotel hosted Ukrainian President Volodymyr Zelenskyy on October 14.

Researchers assessed with low confidence that an Australian medical clinic with no obvious strategic value may have been used to target specific individuals. The campaign gathered every cookie in the browser and applied no hardcoded filter aimed at particular websites. They did not disclose the number of compromised devices.

Traces of a 2025 APT29 watering hole operation found on one hacked site contributed to the attribution, as did parallels with a 2024 APT29 operation against Mongolian government websites that Google’s Threat Analysis Group confirmed. Microsoft said the group spent months over the summer taking over hotel and conference center Wi-Fi networks to steal Microsoft 365 login details and push out malware. Sekoia said its analysis backed the view that APT29 got the exploits from an outside source. “This watering hole campaign, which we assess with moderate to high confidence to be linked to APT29,” Sekoia said.

“a user running an up-to-date operating system is safe from these attacks,” Sekoia said. The firm is working with the CERTs of affected countries, including CERT-UA, to identify victims and disrupt the watering hole infrastructure. It assessed that state-sponsored groups will likely reuse packaged mobile exploit frameworks such as DarkSword more often, and that packaged n-day exploit chains also reduce the expense and skill needed for advanced mobile exploitation.