The cybersecurity company attributes the operation to Russian hacking group APT29 with moderate-to-high confidence. The attacks exploited flaws to target visitors without requiring another click; Apple and Google have patched them.
Attackers used compromised and imitation websites to target iOS and Android visitors without further interaction, cybersecurity company Sekoia found. Code on the sites identified each visitor’s device and browser version, allowing an attacker-controlled server to send a matching sequence of exploits.
The campaign exploited flaws that Apple and Google have patched. Sekoia attributes the operation to the Russian hacking group APT29, also known as Midnight Blizzard, with moderate-to-high confidence, BleepingComputer said.
Sekoia found that attackers had compromised Plerdy, a Ukrainian web analytics service, and altered its search-engine optimization tracker. Thousands of websites, mostly in Ukraine, loaded the altered tracker between 27 August and 3 September. That is a count of websites loading the tracker, not of devices successfully compromised; the number of compromised devices was not supplied.
The campaign used sites in the United States, Ukraine, the Czech Republic and Bulgaria. Compromised sites included those of a Ukrainian gas producer, a US chemical industry trade association and a Bulgarian military-related organization. Separate lookalike domains impersonated the America250 site and the Raffles London at The OWO hotel, relaying content from their real sites.
Sekoia identified three exploit chains, each using a series of software flaws to reach data on a visitor’s device:
The Interior Ministry says police dismantled the group’s criminal infrastructure and seized computers and communication devices during searches of homes and offices.
Researchers also found 4 other vulnerabilities in unreachable code or alternative exploit paths, but those were not used in the chains they analyzed. CVE-2025-43529, used in the iOS chains, is linked to the DarkSword exploit kit, documented in March and used by multiple threat groups since at least November 2025.
US and allied intelligence agencies associate APT29, also known as Cozy Bear, with Russia’s Foreign Intelligence Service (SVR). Sekoia based its attribution of this operation on similarities to earlier attacks using compromised websites, overlapping infrastructure and a compromised site that a partner linked to an APT29 campaign in 2025.
Apple and Google have patched all the flaws targeted in the campaign, including with fixes for older iOS releases. Users should install the latest security updates available for their devices.
Sekoia said the analyzed payloads did not persist after a reboot, so restarting a device stops their activity. Visiting a compromised site again can restart an infection, making updates necessary even after a reboot.
2 min
The 3 November 2026, vote approved local bans and other limits, including a measure aimed at a campus already under construction in Ashville. The effects on individual Amazon projects remain unresolved.
2 min
The proposed bill would let the regulator order compensation, impose fines and ban operators that push households and businesses into overpriced contracts.
2 min
