APT29 Hijacks Web Analytics to Deliver Mobile Exploits
State-sponsored actors leverage supply chain attacks to compromise iOS and Android devices via browser exploits.
1Supply Chain Compromise
The Russia-linked APT29 group initiated a large-scale watering hole campaign by compromising the Plerdy SEO Tracker analytics service. This supply chain attack allows attackers to inject malicious JavaScript into legitimate websites. The code profiles visitor devices, identifying browser and hardware attributes to determine if the target is suitable for specific exploit delivery.
2Targeted Infection Vectors
Infection vectors include compromised industry trade associations, European political parties, and military-related websites. Researchers identified that the campaign specifically targets high-value individuals, such as military personnel and special forces members. The infrastructure uses fake domains and compromised sites to ensure that only specific, non-bot traffic receives the malicious payload delivery.
3Exploit Chain Mechanics
The campaign utilizes N-day exploit chains to compromise mobile devices without user interaction. iOS users are targeted with the DarkSword or Coruna kits, while Android users face malware capable of stealing browser cookies and Wi-Fi passwords. These exploits bypass traditional security by targeting the browser directly, requiring no clicks or app installations.
4Platform Specific Targeting
The Android malware includes a specific check for the Samsung Galaxy S25 Ultra, model SM-S938B, terminating activity if detected. This suggests a highly calibrated operation designed to avoid detection on specific hardware. The exfiltrated data is routed to a telemetry endpoint, mimicking patterns seen in previous state-sponsored campaigns like AndroSnitch.
5Evolution of DeadTag
The DeadTag campaign leverages over 660 expired domains previously associated with advertising and analytics tags. Attackers re-register these domains to serve malicious scripts to unsuspecting visitors. This method allows the group to maintain a persistent delivery infrastructure, redirecting users to exploit kits based on their specific iOS version and browser configuration.
6Commercial Surveillance Reuse
APT29 is increasingly adopting commercial surveillance vendor exploit frameworks like DarkSword to lower operational costs. By utilizing packaged N-day chains, state-sponsored actors reduce the technical threshold required for advanced mobile exploitation. This trend marks a shift toward reusing leaked or purchased tools to conduct sophisticated, targeted surveillance operations against strategic entities.
7Browser-Level Compromise
Unlike phishing, these attacks exploit the browser itself, meaning simply opening a page triggers the compromise. Kits like Coruna and DarkSword P7 function silently, breaking out of the browser sandbox to install spyware. Lure sites often instruct users to switch to Safari, ensuring the exploit chain successfully executes on the target device.
8Strategic Security Implications
The widespread use of re-registered domains and analytics supply chain attacks highlights critical gaps in web security. As exploit kits become more accessible, the barrier to entry for high-impact mobile espionage continues to drop. Organizations must prioritize visibility into third-party scripts and monitor for unauthorized redirects to mitigate these evolving threats.
Original article: The Hacker News — APT29 Hijacks Web Analytics to Deliver Mobile Exploits