APT29-Linked Watering Holes Target Mobile

Visitors to a handful of legitimate websites in the U.S., Ukraine, the Czech Republic, and Bulgaria were not simply reading the news or browsing a trade association's pages. According to research published by cybersecurity firm Sekoia, a watering-hole operation tied with moderate-to-high confidence to the Russian threat group APT29 was profiling them and, in some cases, delivering exploit chains built for their specific devices. The campaign is the latest example of a state-linked actor reusing known vulnerabilities rather than burning fresh zero-days, and it complicates the familiar advice that users simply keep their software up to date.

Watering holes with a mobile focus

Sekoia's researchers describe a large-scale watering-hole attack that targeted iOS and Android users visiting compromised sites or fake sites impersonating legitimate portals. The campaign used multiple high-profile websites in the U.S., Ukraine, the Czech Republic, and Bulgaria, all delivering the same initial payload for profiling visitors and their devices.

The compromised legitimate sites, according to the findings, belong to a Ukrainian gas producer, a U.S. chemical industry trade association, and a Bulgarian military-related site. Separately, lookalike domains impersonated the official America250 site and Raffles London at The OWO hotel, relaying content from the real sites in what Sekoia describes as an adversary-in-the-middle attack model.

The researchers also found that the threat actor had compromised Ukrainian web analytics service Plerdy and modified its SEO tracker, which was loaded by thousands of websites, mostly in Ukraine, between August 27 and September 3. That detail matters because it shows the operation was not confined to a few targeted destinations; a widely embedded third-party script gave the attackers a much broader reach.

Profiling first, exploits second

In every observed case, the initial payload was JavaScript code that profiled website visitors to determine their devices and browser versions. The command-and-control (C2) server then pushed the correct exploit chain. Sekoia says the campaign deployed "platform-specific n-day exploit chains without user interaction."

"platform-specific n-day exploit chains without user interaction"

— Sekoia researchers, in their published analysis

This two-stage design is a common feature of modern watering-hole operations: the first script does reconnaissance, and the second stage is selected on the server side based on what the browser reports. The result is that a vulnerable visitor receives an exploit chain tailored to their platform, while others do not receive the same payload.

The iOS chains and what they took

Sekoia lists the vulnerabilities exploited in the campaign and the data each chain attempted to extract. For devices running iOS 16.7, the payload combined CVE-2025-43529 and CVE-2024-27834 and targeted cookies stored in Safari. On iOS 18.5, the chain drew on CVE-2025-43529, CVE-2026-20700, CVE-2025-14174, CVE-2025-43510, and CVE-2025-43520, harvesting WhatsApp and Telegram databases, Keychain credentials, location data, and photos.

CVE-2025-43529 has a prior history. It is linked to the "DarkSword" exploit kit, first documented in March, and has been leveraged in attacks since at least November 2025 by multiple threat groups. That reuse across actors is one reason Sekoia's findings are notable: a single patched flaw can keep appearing in unrelated campaigns long after a fix is available.

The researchers identified four other vulnerabilities in unreachable code or alternate exploit paths, but those were not used in the analyzed chains. That detail suggests the campaign may have had more exploit options than it ultimately deployed, though the researchers do not speculate publicly on why those paths went unused.

Android and the AndroSnitch tool

On the Android side, the campaign targeted Chrome for Android versions 139 to 145, excluding 143, using CVE-2026-3910 and CVE-2025-27038. The payload employed a tool Sekoia calls AndroSnitch to collect Chrome cookies, login data, browsing history, and saved WiFi credentials.

The version range is specific and excludes one release, which may reflect the exploit's compatibility rather than a deliberate choice to spare users of that build. The data collected is the kind that lets an attacker move laterally: session cookies and saved WiFi credentials can be used to access accounts and networks without needing to crack passwords.

Attribution and the APT29 link

Sekoia attributes the operation to APT29 (also known as Midnight Blizzard) with moderate-to-high confidence. The group is a Russian threat actor that was recently linked to hotel WiFi attacks. The researchers cite similarities to past watering-hole operations by the same group, infrastructure overlaps, and a compromised site that a partner linked to a 2025 APT29 campaign.

Moderate-to-high confidence is a calibrated judgment rather than a certainty, and Sekoia's report lays out the supporting evidence without claiming absolute proof. The attribution rests on a combination of technical overlaps and third-party reporting, which is typical for private-sector tracking of state-linked groups.

No persistence, but a broad net

According to Sekoia, none of the payloads APT29 used in these attacks established persistence. That means a device reboot stops the malicious activity until the user visits a compromised site again. It also means the campaign was designed for collection in the moment rather than long-term access.

Even without persistence, the combination of compromised legitimate sites, lookalike domains, and a widely loaded analytics script gave the operation multiple ways to reach visitors. The use of an adversary-in-the-middle model on the fake sites added another layer: users who thought they were on a real hotel or commemorative site were in fact interacting with attacker-controlled infrastructure.

Patches exist for every flaw used

Apple and Google have patched all flaws targeted in this campaign, with fixes even reaching older iOS releases. Sekoia recommends that users apply the latest available security updates for their devices. The fact that fixes exist for every exploited vulnerability is central to the story: this was not a campaign that depended on unknown flaws, but on systems that had not yet received available patches.

For organizations, the relevant question is less about whether a patch exists and more about how quickly it is applied across the devices that access public web content. Mobile devices are often updated on the user's schedule rather than an IT department's, and that gap is what n-day exploitation is built to find.

What the data points add up to

• 4 countries with compromised high-profile websites: the U.S., Ukraine, the Czech Republic, and Bulgaria.
• August 27 to September 3: the window during which the modified Plerdy SEO tracker was loaded by thousands of websites, mostly in Ukraine.
• iOS 16.7 and iOS 18.5: the two iOS versions with distinct exploit chains described by Sekoia.
• Chrome for Android 139 to 145, excluding 143: the browser range targeted by the Android chain.
• November 2025: the earliest point since which CVE-2025-43529 has been leveraged in attacks, according to the researchers.

These figures sketch a campaign that was selective about platforms but broad in its choice of lures. The use of both real compromised sites and lookalike domains suggests the attackers were willing to cast a wide net and let the profiling script sort out who was worth exploiting.

Why this matters beyond the four sites

The immediate takeaway for readers is that the flaws involved have patches, and applying them removes the specific exploit chains Sekoia documented. That is a concrete, actionable step rather than a vague warning. The campaign also illustrates a broader pattern: state-linked actors continue to find value in n-day vulnerabilities, and the infrastructure they use—compromised analytics scripts, lookalike domains, and legitimate sites—can be difficult for visitors to distinguish from normal web traffic.

For businesses, the findings suggest that third-party scripts embedded across many websites can extend an attacker's reach well beyond the site they originally compromised. The Plerdy incident is a reminder that the supply chain of web content includes analytics and tracking code, and that a single compromised service can affect thousands of sites. For consumers, the practical advice is unchanged but newly relevant: keep mobile operating systems and browsers current, and be cautious about sites that relay content through unfamiliar domains.

Sekoia's report does not claim that every visitor to the affected sites was compromised. It describes a profiling stage and targeted exploit delivery, with the specific data collection varying by platform. That nuance is worth keeping in mind as coverage of the campaign develops.