Kremlin-Linked Hackers Hit Phones via Watering Holes

A visitor lands on what looks like the official site for a national anniversary celebration. The page loads normally, but JavaScript slipped into the traffic begins quietly taking stock of the device in front of it — its browser, its platform, its version. What happens next depends on what that profiling turns up, and according to researchers at the security firm Sekoia, the answer in some cases was a zero-click exploit chain built to run on phones that had not been updated.

Sekoia reported that the operation targeted visitors to multiple websites, including one marking the 250th anniversary of the signing of the US Constitution, and that it assessed with “moderate to high confidence” that the intruders were part of Russia’s Foreign Intelligence Service. The findings, attributed to the firm’s own analysis, describe an infrastructure built to profile and then compromise mobile visitors rather than to deface or disrupt the sites themselves.

Fake mirrors, real content

The attackers did not need to break into the sites they impersonated. Instead, they registered a lookalike domain, america250[.]holiday, and used it as a reverse proxy in front of america250.org. The impersonated site pulled legitimate content from the real one and injected malicious JavaScript into it along the way.

By Sekoia’s account, the group may have chosen that target for reasons beyond its traffic. The firm said the intrusion set appeared to deliberately select the site because of its ties to a high-profile national celebration, and suggested the event could serve as a pretext for invitation-themed spear-phishing. The organization behind america250.org is described in the source material as a non-partisan group of lawmakers, business executives, and at least one former member of the Trump administration.

A second proxy domain, theowo[.]club, stood in front of the website for Raffles of London OWO, a luxury hotel. The source notes the hotel’s physical proximity to some of the UK’s most sensitive government institutions, including the Ministry of Defence and 10 Downing Street. It also cites open source reporting that Ukrainian President Volodymyr Zelenskyy stayed there during a visit on October 14.

Supply chain and compromised sites

Proxy domains were only one of the routes the operation used. Sekoia said the attackers also delivered attacks through compromised websites, including a top Ukrainian gas production company, and through a Ukrainian web analytics service that serves thousands of websites. That last vector is a supply-chain compromise: a script that many sites load by design became a delivery mechanism for the malicious JavaScript.

Across all three routes, the injected JavaScript was the same, according to the firm. The first stage profiled the visitor’s browser and device. That profile then determined which of three zero-click exploit chains the visitor received — chains that, by definition, require no interaction from the person on the other end.

Many of the targets had links to Russia’s ongoing war against Ukraine, the source states. The operation is described as reaching potentially hundreds of different sites, with attacks beginning when an iPhone or Android user visited one of them.

The DarkSword connection

One of the three chains was DarkSword, an iOS exploit kit that Google researchers said had been used by customers of PARS Defense, a commercial surveillance vendor in Turkey, and by at least two other threat actors. Sekoia said the more recent campaign used two other exploit chains that were not named.

What the payloads went after was consistent with espionage rather than smash-and-grab fraud. The tailored final payloads attempted to steal browser cookies and, in some cases, Wi-Fi passwords and full mobile device data, according to the source.

Sekoia’s attribution rests on the profiles of the targets and on similarities to a previous attack attributed to APT29, one of the names used to track the suspected Russian group. The firm’s conclusion about the Foreign Intelligence Service carries its own stated confidence level — moderate to high — rather than a flat assertion.

“We assess that the intrusion set may have deliberately selected this website due to its association with a high-profile national celebration, potentially leveraging the event as a pretext for invitation-themed spear-phishing campaigns,” researchers from security firm Sekoia said.

— Researchers from security firm Sekoia

The firm offered a parallel assessment for the hotel proxy, framing the choice of Raffles London at The OWO as a possible route to diplomatic delegations and high-profile guests rather than to the hotel’s ordinary customers.

N-days, not zero-days

The most consequential technical detail may be the least novel one. Every vulnerability exploited in the campaign was an n-day — already patched, with attacks working only against outdated versions of iOS or Android. The zero-click label describes the exploitation method, not the freshness of the bugs.

That distinction shapes who was actually reachable. The exploits did not work through newly discovered flaws with no fix available; they worked because the devices that received them had not yet taken updates that already existed.

The firmware-level detail matters as well. The final payloads were tailored to the type of platform visiting, meaning the same injected profiling script could sort an iPhone from an Android device and hand each one a chain built for it. Wi-Fi password theft, where it occurred, points to data beyond the browser session.

What the attackers collected

The stated objectives — browser cookies, Wi-Fi passwords, and full mobile device data in some cases — map onto the classic concerns of mobile espionage. Cookies can carry live session state for web services. Wi-Fi credentials can open other networks to whoever holds them. Full device data, where obtained, is the broadest category of the three.

The source does not specify how many devices were compromised or which countries the victims were in beyond the target-site profiles. It also does not describe the two unnamed exploit chains, leaving DarkSword as the only one of the three the researchers identified publicly.

The numbers behind the campaign

• Three infection vectors: direct JavaScript injection into traffic from legitimate websites, proxy domains such as america250[.]holiday, and the supply-chain compromise of the Ukrainian web analytics service.
• Three zero-click exploit chains delivered after device profiling, one of them DarkSword.
• One named iOS exploit kit — DarkSword — previously linked by Google researchers to PARS Defense customers in Turkey and at least two other threat actors.
• Thousands of websites served by the compromised Ukrainian web analytics service.
• October 14, the date of Zelenskyy’s reported stay at Raffles London at The OWO, per open source reporting cited in the source material.
• 250th anniversary of the signing of the US Constitution, the occasion tied to the impersonated america250.org site.

Attribution and its limits

Sekoia’s case for Russian state involvement is built on target selection and on overlap with earlier activity. The target profiles lean heavily toward entities connected to the war in Ukraine, and the firm points to similarities with a prior attack attributed to APT29.

Attribution of this kind is an assessment, not a proof, and Sekoia’s own language reflects that: the Foreign Intelligence Service link is offered at moderate to high confidence. The firm’s description of the group’s motives for choosing the anniversary site and the London hotel is likewise framed as a possibility — what the intrusion set “may have” sought — rather than a documented plan.

Google’s earlier findings on DarkSword add a separate thread. That kit’s documented use by a commercial surveillance vendor’s customers and by other threat actors indicates the tooling has circulated beyond any single operator, even though the source does not say how this campaign obtained it.

Why this matters for defenders

The practical lesson sits in the n-day detail. The campaign’s reach depended on visitors running software that had not yet been updated, which suggests that for individuals, the gap between a patch’s release and its installation is the exposure window these operators were counting on. For organizations, the targeting pattern — a national celebration site, a hotel near government buildings, a gas producer, an analytics service — points to a threat model in which the websites an employee or official visits, and the update state of the phone they visit them on, both fall inside the perimeter.

Third-party scripts deserve a second look for site operators. The analytics service compromise shows that a trusted embed can become a delivery path without the site itself being breached, and the proxy technique shows that an attacker can serve a site’s own legitimate content while altering what runs alongside it. Visitors have no easy way to tell a mirrored domain from the real one; registries and brand owners do.

Finally, the source’s account suggests that cookie and credential theft remain the payoff that makes mobile exploitation worth the effort. Sessions that survive a password change, and Wi-Fi credentials that outlive a single device, are the kind of material that keeps an intrusion useful after the first phone is cleaned.