Key Takeaways
- Sekoia said on November 4, 2026, that it assesses with moderate to high confidence that APT29, also tracked as Midnight Blizzard and Cozy Bear and widely attributed to Russia's foreign intelligence service (SVR), ran a watering hole campaign against iPhone and Android users.
- The APT29 campaign tampered with the Plerdy SEO Tracker, an analytics script loaded by thousands of mostly Ukrainian websites, from August 27 to September 3, 2026, according to Sekoia.
- The APT29 exploit chains targeted phones running iOS 16.7, iOS 18.5, or Chrome versions 139 to 145 on Android and used only flaws that had been fixed before the campaign began, Sekoia said.
- CISA added Apple flaw CVE-2024-27834, part of one APT29 exploit chain, to its Known Exploited Vulnerabilities catalog on November 4, 2026, with a remediation deadline of November 18 for U.S. federal civilian agencies.
What happened
Researchers at Sekoia, a French cybersecurity company, said in a report published on November 4, 2026, that they had uncovered a large watering hole campaign in mid-October. In a watering hole attack, hackers plant malicious code on websites that their targets are likely to visit. The investigation began with a malicious script on the website of a Ukrainian gas production company.
Sekoia assesses with moderate to high confidence that the campaign was run by APT29, also tracked as Midnight Blizzard, Cozy Bear, or The Dukes, or by one of its subgroups. Sekoia describes APT29 as a group widely attributed to Russia's foreign intelligence service, the SVR. The Hacker News reported that Sekoia calls the activity Poisoned Source.
The attackers reached visitors in three ways, Sekoia said: code planted on legitimate websites, lookalike websites that relayed the real sites' pages with extra code added, and a one-week compromise of a Ukrainian web analytics service. Each route loaded a script that identified the visitor's phone and browser version. The attackers' server then sent an exploit chain, a sequence of attacks on several flaws, built for that device. According to Sekoia, the chains ran without user interaction.
Which websites and phones were targeted
Compromised websites included those of a U.S. trade association for the chemical industry, a far-right European political party, and a Bulgarian military-related organization, Sekoia said. Some, such as the site of an Australian medical clinic, had no obvious strategic value, Help Net Security reported.
Two lookalike sites copied the website of America250, the U.S. initiative marking the 250th anniversary of American independence, and of Raffles London at The OWO, a luxury hotel near the UK Ministry of Defence and 10 Downing Street. Sekoia said the hotel copy may have been meant to target diplomatic delegations and prominent guests.
From August 27 to September 3, 2026, the attackers added their code to the Plerdy SEO Tracker, an analytics script that thousands of websites load, most of them Ukrainian, Sekoia said. Those sites include army, special forces, and military equipment websites. Sekoia said it is unclear whether the attackers were after visitors to particular sites or wanted to compromise as many unpatched phones as possible.
Sekoia retrieved three exploit chains:
-
•
The chain for iOS 16.7 steals browser cookies, which can let attackers reuse logged-in sessions, according to Help Net Security.
-
•
The chain for iOS 18.5 uses the DarkSword exploit kit to collect text messages and iMessages, WhatsApp and Telegram data, Keychain passwords, location data, and photos, according to Help Net Security. Sekoia says a commercial surveillance vendor is suspected of building DarkSword.
-
•
The chain for Chrome versions 139 to 145 on Android, except version 143, collects Chrome cookies, saved logins, browsing history, and Wi-Fi passwords, according to Help Net Security.
None of the malware stays on a phone after a restart, BleepingComputer reported. The researchers did not say how many devices were compromised, Infosecurity Magazine reported.
Flaws used and patches
The three chains used eight flaws: CVE-2025-43529, CVE-2024-27834, CVE-2026-20700, CVE-2025-14174, CVE-2025-43510, CVE-2025-43520, CVE-2026-3910, and CVE-2025-27038. Sekoia said every one had been fixed by its vendor before the campaign began, and that none of the chains contain zero-days, flaws unknown to the vendor.
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2024-27834 to its Known Exploited Vulnerabilities (KEV) catalog on November 4, 2026, based on evidence of active exploitation, according to its alert. The KEV entry sets November 18 as the deadline for U.S. federal civilian agencies. Apple fixed the flaw in iOS 17.5, released on May 13, 2024.
Why Sekoia blames APT29
Sekoia cited traces of a 2025 watering hole campaign attributed to APT29 found on one compromised website, which a partner matched to a private report. Google's Threat Analysis Group told Sekoia that the attack framework resembles a 2024 APT29 campaign against Mongolian government websites. Sekoia also pointed to victims spread across Europe and the U.S. with a focus on Ukraine, which it called consistent with Russian interests.
Sekoia said its analysis supports the idea that the exploits came from a third party. It said it is working with the national computer emergency response teams (CERTs) of the affected countries, including Ukraine's CERT-UA, to identify victims and assess ways to disrupt the attackers' websites.
What users and organizations should do
"A user running an up-to-date operating system is safe from these attacks," Sekoia said. On its security releases page, Apple says keeping software up to date is one of the most important things owners can do to keep its products secure.
Sekoia published some indicators of compromise in its report. It said other indicators, YARA detection rules, and details of the compromised websites are available in its Sekoia CTI service, and that it can share indicators and samples with national CERTs and law enforcement agencies.