# Russian APT29 Launches Large-Scale Watering Hole Attacks Targeting iOS and Android Users State-sponsored actors leverage compromised websites and analytics supply chains to deploy advanced mobile exploit kits. - **Source:** [Security Affairs](https://brifing.si/source/e6c4f5ec-3e1b-4152-a932-056243bd56eb) - **Published:** 2026-11-05 - **Topic:** [technology](https://brifing.si/c/technology) - **Original article:** - **On Brifing:** https://brifing.si/s/876bb22f-19b5-4986-8b2b-076f5dfd02fd ## Sophisticated Watering Hole Campaign The Russia-linked group APT29, also known as Midnight Blizzard, launched a widespread watering hole campaign in mid-October 2026. By compromising high-profile websites and a Ukrainian analytics service, attackers deliver malicious payloads to iOS and Android users. This operation demonstrates a strategic shift toward exploiting unpatched mobile devices for intelligence gathering. ## Diverse Infection Vectors Used Attackers utilize three primary methods: injecting malicious JavaScript into hacked websites, creating fake domains mimicking legitimate services, and compromising the Plerdy web analytics tracker. The Plerdy supply-chain attack was particularly impactful, as the script was loaded by thousands of websites, predominantly in Ukraine, between August 27 and September 3, 2026. ## Strategic Targeting of High-Value Sites Compromised platforms include military recruitment sites, special forces portals, and a major U.S. chemical industry association. Researchers noted a fake website impersonating the Raffles London hotel, located near the UK Ministry of Defence. This site may have targeted diplomatic delegations, especially given President Zelensky’s reported stay there on October 14. ## Advanced Profiling and Data Collection A custom profiling script, dubbed UltimateFingerprinter, runs 61 collectors to build 394 distinct data fields from visitor browsers. While the attackers gather massive amounts of telemetry, most data appears irrelevant to the final exploit delivery. This complexity, including a 2.3 MB minified AngularJS library, likely aims to evade automated security analysis. ## Platform-Specific Exploit Chains The delivery infrastructure serves three distinct exploit classes. Class A targets iOS 16.7 to steal cookies, while Class B exploits iOS 18.5 for full device data extraction. Android users running Chrome versions 139 to 145 face exploits stealing Wi-Fi passwords and browser cookies, though the malware specifically avoids Samsung Galaxy S25 Ultra devices. ## Reuse of Commercial Surveillance Tools The operation confirms the state-sponsored adoption of commercial mobile exploit frameworks like DarkSword. By utilizing packaged N-day exploits, APT29 lowers the technical threshold and costs required for advanced mobile surveillance. This trend mirrors other recent campaigns, such as DeadTag, which also weaponize expired analytics tags to silently compromise mobile browser sessions. ## Indiscriminate vs. Targeted Objectives It remains unclear if the campaign seeks to compromise as many unpatched devices as possible or specifically targets high-value individuals. The attackers exfiltrate data indiscriminately before selectively identifying information of interest. This methodology allows the group to maintain a broad reach while focusing resources on strategically important targets during the war. ## Implications for Mobile Security These attacks highlight the danger of browser-based exploits that require no user interaction to trigger. Because the kits attack the browser itself, simply visiting a compromised page can lead to full device spyware installation. Users must remain vigilant, as even legitimate-looking websites can now serve as silent gateways for sophisticated state-sponsored surveillance. ## Sources covering this story - [Security Affairs — Russian APT29 Targets Mobile Users with Watering Hole Attacks](https://securityaffairs.com/202473/apt/russian-apt29-targets-mobile-users-with-watering-hole-attacks.html) - [The Hacker News — APT29 Hijacks Web Analytics to Deliver Mobile Exploits](https://thehackernews.com/2026/11/apt29-linked-hackers-hijack-web.html) --- _Summary written by Brifing from the original reporting. Copyright in the original article belongs to its publisher; read the full piece at the link above._