A large-scale watering hole attack associated with Russian hackers targeted iOS and Android users by compromising legitimate websites and creating fake portals, using n-day exploit chains delivered without user interaction, cybersecurity firm Sekoia has reported.
The campaign, attributed with moderate-to-high confidence to the Russian threat group APT29 (also known as Midnight Blizzard), hit multiple high-profile websites in the United States, Ukraine, the Czech Republic and Bulgaria. Compromised sites included those belonging to a Ukrainian gas producer, a U.S. chemical industry trade association and a Bulgarian military-related site. Lookalike domains impersonated the official America250 site and the Raffles London at The OWO hotel, relaying content from the real sites in an adversary-in-the-middle attack model.
Researchers also found that the threat actor had compromised Ukrainian web analytics service Plerdy and modified its SEO tracker, which was loaded by thousands of websites, mostly in Ukraine, between August 27 and September 3.
In all cases, the initial payload was JavaScript code that profiled website visitors to determine their devices and browser versions. The command-and-control server then pushed the correct exploit chain. According to Sekoia, the exploits were deployed without user interaction.
The following vulnerabilities were exploited: CVE-2025-43529 and CVE-2024-27834 in iOS 16.7, targeting Safari cookies; CVE-2025-43529, CVE-2026-20700, CVE-2025-14174, CVE-2025-43510 and CVE-2025-43520 in iOS 18.5, harvesting WhatsApp and Telegram databases, Keychain credentials, location data and photos; and CVE-2026-3910 and CVE-2025-27038 in Chrome for Android 139 to 145 (excluding 143), using AndroSnitch to collect Chrome cookies, login data, browsing history and saved WiFi credentials.
Sekoia said the payloads did not establish persistence; a device reboot could stop malicious activity until the user visited a compromised site again. The researchers attributed the operation to APT29 based on similarities to past watering-hole operations, infrastructure overlaps, and a compromised site that a partner linked to a 2025 APT29 campaign.
Apple and Google have patched all flaws targeted in this campaign, with fixes reaching older iOS releases. Users are recommended to apply the latest security updates for their devices.
Analysis
Why This Matters
- The campaign exploits n-day vulnerabilities (already patched but unapplied by users), emphasizing the importance of timely software updates.
- Zero-click attacks mean users can be compromised simply by visiting a website, without any action on their part.
- The targeting of multiple high-profile sites and an analytics service shows the breadth of the watering hole strategy, affecting widely different audiences.
Background
APT29, also known as Midnight Blizzard, is a Russian state-sponsored threat group that has been active for over a decade. It has previously targeted government, diplomatic and technology organizations. Watering hole attacks involve compromising websites that a target group is likely to visit, then using those sites to deliver malware. This campaign uses n-day exploits, which target vulnerabilities that have been disclosed and patched but remain unaddressed on many devices.
Key Perspectives
Sekoia: with moderate-to-high confidence attributes the operation to APT29, noting similarities to past watering-hole operations by the same group, infrastructure overlaps and a compromised site linked to a 2025 APT29 campaign.
What to Watch
- Whether additional compromised sites or analytics services are identified.
- How quickly affected organizations patch the exploited vulnerabilities.
- Future APT29 campaigns using similar watering-hole techniques or new exploit chains.
Checked
12 claims in this story checked against 1 source: 11 supported.
Show each claim
- Partly supportedRussian hackers deployed n-day exploits in zero-click attacks on iOS and Android devices.BleepingComputer: “A large-scale watering hole attack associated with Russian hackers”
- SupportedThe campaign was linked to APT29 and used compromised websites and fake portals to profile visitors and deliver platform-specific exploit chains.BleepingComputer: “This initial stage allows the attacker to determine the browser version to deploy "platform-specific n-day exploit chains without user interaction."”
- SupportedSekoia attributed the operation to APT29 with moderate-to-high confidence, citing similarities to past watering-hole operations, infrastructure overlaps and a site linked by a partner to a 2025 APT29 campaign.BleepingComputer: “Researchers at cybersecurity company Sekoia attribute the operation with moderate-to-high confidence to APT29 (aka Midnight Blizzard)”
- SupportedThe campaign involved high-profile sites in the U.S., Ukraine, the Czech Republic and Bulgaria, including sites belonging to a Ukrainian gas producer, a U.S. chemical industry trade association and a Bulgarian military-related site.BleepingComputer: “Based on their findings, compromised legitimate sites belong to a Ukrainian gas producer, a U.S. chemical industry trade association, and a Bulgarian military-related site.”
- SupportedLookalike domains impersonated the official America250 site and Raffles London at The OWO hotel, relaying content from the real sites in an adversary-in-the-middle attack model.BleepingComputer: “Lookalike domains impersonated the official America250 site and Raffles London at The OWO hotel, relaying content from the real sites in an adversary-in-the-middle attack model.”
- SupportedThe threat actor compromised Ukrainian web analytics service Plerdy and modified its SEO tracker, loaded by thousands of websites, mostly in Ukraine, between August 27 and September 3.BleepingComputer: “the threat actor had compromised Ukrainian web analytics service Plerdy and modified its SEO tracker, which was loaded by thousands of websites, mostly in Ukraine, between August 27 and September 3.”
- SupportedJavaScript profiled visitors’ devices and browser versions, after which the command-and-control server pushed the appropriate exploit chain.BleepingComputer: “In all cases, the initial payload was JavaScript code that profiled website visitors to determine their devices and browser versions. The command-and-control (C2) server then pushed the correct exploit chain.”
- SupportedThe campaign exploited CVE-2025-43529 and CVE-2024-27834 in iOS 16.7 to target Safari cookies.BleepingComputer: “CVE-2025-43529 and CVE-2024-27834 (in iOS 16.7). The payload targets cookies stored in Safari.”
- SupportedThe campaign exploited CVE-2025-43529, CVE-2026-20700, CVE-2025-14174, CVE-2025-43510 and CVE-2025-43520 in iOS 18.5 to harvest messaging-app databases, Keychain credentials, location data and photos.BleepingComputer: “CVE-2025-43529, CVE-2026-20700, CVE-2025-14174, CVE-2025-43510, and CVE-2025-43520 (in iOS 18.5). The payload harvests WhatsApp and Telegram databases, Keychain credentials, location data, and photos.”
- SupportedThe campaign exploited CVE-2026-3910 and CVE-2025-27038 in Chrome for Android versions 139 to 145, excluding 143, using AndroSnitch to collect Chrome cookies, login data, browsing history and saved WiFi credentials.BleepingComputer: “CVE-2026-3910 and CVE-2025-27038 (in Chrome for Android 139 to 145, excluding 143). Uses AndroSnitch to collect Chrome cookies, login data, browsing history, and saved WiFi credentials.”
- SupportedThe payloads did not establish persistence, so rebooting a device could stop the malicious activity until the user visited a compromised site again.BleepingComputer: “none of the payloads APT29 used in these attacks established persistence, allowing a device reboot to stop the malicious activity until visiting a compromised site again.”
- SupportedApple and Google patched all flaws targeted in the campaign, with fixes reaching older iOS releases, and users are recommended to apply the latest available security updates.BleepingComputer: “Apple and Google have patched all flaws targeted in this campaign, with fixes even reaching older iOS releases, so users are recommended to apply the latest available security updates for their devices.”
