[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fheIg8aeFpwupjntM6Ifxy38x87eS5EdfO4DeKezReXA":3},{"article":4,"iocs":54,"watch_terms":65,"solutions":66,"lesson":163},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":31,"category":32,"article_tags":36},"52ea3ac8-9d86-4323-b6d8-1f4ec352a2ce","Russia-Linked Hackers Hit iOS, Android Devices With Exploit Chains via Watering Holes","russia-linked-hackers-hit-ios-android-devices-with-exploit-chains-via-watering-h-44bf9c","The large-scale watering hole campaign has been targeting entities in the US and Europe, mainly in Ukraine. The post Russia-Linked Hackers Hit iOS, Android Devices With Exploit Chains via Watering Holes appeared first on SecurityWeek.","Russian state-sponsored threat actor Midnight Blizzard (APT29) has launched a large-scale watering hole campaign targeting users in the US and Europe, primarily Ukraine. The campaign leverages compromised websites and a supply chain attack on a web analytics service to deliver exploit chains targeting n-day vulnerabilities on iOS and Android devices. The ultimate goal appears to be extensive data harvesting, including sensitive personal information and credentials.","Russia-linked Midnight Blizzard targets iOS and Android users with exploit chains via compromised websites.","https:\u002F\u002Fwww.securityweek.com\u002Frussia-linked-hackers-hit-ios-android-devices-with-exploit-chains-via-watering-holes\u002F","https:\u002F\u002Fwww.securityweek.com\u002Fwp-content\u002Fuploads\u002F2024\u002F10\u002FMidnight-Blizzard-Russia-1024x576.png","2026-11-05T10:37:13+00:00","2026-11-05T11:00:19.177498+00:00",9,[17,20,22,24,26,28],{"name":18,"type":19},"Midnight Blizzard","threat_actor",{"name":21,"type":19},"APT29",{"name":23,"type":19},"Cozy Bear",{"name":25,"type":19},"Nobelium",{"name":27,"type":19},"Yttrium",{"name":29,"type":30},"DarkSword","product","6cbdd207-aaa1-4176-9534-e156b125e917",{"id":31,"icon":33,"name":34,"slug":35},null,"Nation-state","nation-state",[37,39,44,49],{"category":38},{"id":31,"icon":33,"name":34,"slug":35},{"category":40},{"id":41,"icon":33,"name":42,"slug":43},"80544778-fabb-4dcd-aa35-17492e5dcf4f","Vulnerabilities","vulnerabilities",{"category":45},{"id":46,"icon":33,"name":47,"slug":48},"89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5","Malware","malware",{"category":50},{"id":51,"icon":33,"name":52,"slug":53},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[55,59,62],{"type":56,"value":57,"context":58},"cve","CVE-2024-27834","iOS vulnerability exploited to bypass PAC protection and steal cookies.",{"type":56,"value":60,"context":61},"CVE-2026-3910","Android Chrome vulnerability exploited.",{"type":56,"value":63,"context":64},"CVE-2025-27038","Android Qualcomm vulnerability exploited.",[29],{"controls":67,"vendors":151},[68,97,122],{"slug":69,"name":70,"problem":71,"products":72},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[73,81,89],{"vendor_slug":74,"vendor_name":75,"vendor_logo":76,"product_slug":77,"product_name":78,"url":79,"description":80},"huntress","Huntress","\u002Fvendor-logos\u002Fhuntress.png","managed-edr","Huntress Managed EDR","https:\u002F\u002Fwww.huntress.com\u002Fplatform\u002Fmanaged-edr","Endpoint detection and response monitored around the clock by Huntress analysts.",{"vendor_slug":82,"vendor_name":83,"vendor_logo":84,"product_slug":85,"product_name":86,"url":87,"description":88},"sentinelone","SentinelOne","\u002Fvendor-logos\u002Fsentinelone.png","singularity-endpoint","Singularity Endpoint","https:\u002F\u002Fwww.sentinelone.com\u002Fplatform\u002Fendpoint-security\u002F","Endpoint protection and detection with automated response and rollback.",{"vendor_slug":90,"vendor_name":91,"vendor_logo":92,"product_slug":93,"product_name":94,"url":95,"description":96},"elastic","Elastic","\u002Fvendor-logos\u002Felastic.png","elastic-security","Elastic Security","https:\u002F\u002Fwww.elastic.co\u002Fsecurity","SIEM and endpoint security built on Elasticsearch, with open detection rules.",{"slug":53,"name":98,"problem":99,"products":100},"Threat intelligence","Attack campaigns reach your sector, suppliers or software before your team hears about them.",[101,109,114],{"vendor_slug":102,"vendor_name":103,"vendor_logo":104,"product_slug":105,"product_name":106,"url":107,"description":108},"dataminr","Dataminr","\u002Fvendor-logos\u002Fdataminr.png","agentic-threat-intelligence-platform","Agentic Threat Intelligence Platform","https:\u002F\u002Fwww.dataminr.com\u002Fproducts\u002Fcyber-defense\u002Fagentic-threat-intelligence-platform\u002F","Threat intelligence platform, formerly ThreatConnect TI Ops, that collects, scores and structures intelligence and pushes it into security tools.",{"vendor_slug":102,"vendor_name":103,"vendor_logo":104,"product_slug":110,"product_name":111,"url":112,"description":113},"dataminr-threat-intelligence","Dataminr Threat Intelligence","https:\u002F\u002Fwww.dataminr.com\u002Fproducts\u002Fcyber-defense\u002Fthreat-intelligence\u002F","Real-time alerts on emerging cyber threats, exploited vulnerabilities and attacks relevant to your organisation, detected with AI across a large set of public data sources.",{"vendor_slug":115,"vendor_name":116,"vendor_logo":117,"product_slug":118,"product_name":119,"url":120,"description":121},"reliaquest","ReliaQuest","\u002Fvendor-logos\u002Freliaquest.png","greymatter-digital-risk-protection","GreyMatter Digital Risk Protection","https:\u002F\u002Freliaquest.com\u002Fsecurity-operations-platform\u002Fdark-web-and-digital-risk-protection\u002F","Watches the open, deep and dark web for threats aimed at an organisation and alerts its security team in real time.",{"slug":123,"name":124,"problem":125,"products":126},"dns-web-filtering","DNS filtering and secure web gateway","Users cannot reach known-malicious sites, and malware cannot phone home.",[127,135,143],{"vendor_slug":128,"vendor_name":129,"vendor_logo":130,"product_slug":131,"product_name":132,"url":133,"description":134},"netskope","Netskope","\u002Fvendor-logos\u002Fnetskope.png","netskope-swg","Netskope Secure Web Gateway","https:\u002F\u002Fwww.netskope.com\u002Fproducts\u002Fnext-gen-swg","Cloud secure web gateway with inspection of web and cloud app traffic.",{"vendor_slug":136,"vendor_name":137,"vendor_logo":138,"product_slug":139,"product_name":140,"url":141,"description":142},"cloudflare","Cloudflare","\u002Fvendor-logos\u002Fcloudflare.png","cloudflare-gateway","Cloudflare Gateway","https:\u002F\u002Fwww.cloudflare.com\u002Fproducts\u002Fgateway\u002F","DNS filtering and secure web gateway.",{"vendor_slug":144,"vendor_name":145,"vendor_logo":146,"product_slug":147,"product_name":148,"url":149,"description":150},"cisco","Cisco","\u002Fvendor-logos\u002Fcisco.png","umbrella","Cisco Umbrella","https:\u002F\u002Fumbrella.cisco.com\u002F","DNS-layer security and secure web gateway delivered from the cloud.",[152,158],{"slug":153,"name":154,"logo_path":155,"roles":156},"apple","Apple","\u002Fvendor-logos\u002Fapple.png",[157],"affected",{"slug":159,"name":160,"logo_path":161,"roles":162},"google","Google","\u002Fvendor-logos\u002Fgoogle.png",[157],{"slug":164,"title":165,"body":166,"framework_refs":167,"framework_notes":175},"apt29-watering-hole-campaign-exploits-unpatched-ios-android-devices-via-compromised-analytics-supply","APT29 Watering Hole Campaign Exploits Unpatched iOS & Android Devices via Compromised Analytics Supply Chain","Russia-linked APT29 (Midnight Blizzard) compromised legitimate websites and injected malicious code through a hijacked web analytics service to silently deliver exploit chains targeting known but unpatched vulnerabilities on iOS and Android devices. The use of n-day vulnerabilities — flaws with existing patches — means that timely patching alone could have blocked the initial exploitation vector on victim devices. The supply chain angle amplifies the threat significantly, as even cautious users visiting trusted sites were exposed without any direct interaction with obviously malicious content. This campaign demonstrates how adversaries chain together third-party trust relationships and delayed patching to maximise reach and deniability. The ultimate harvest of credentials and personal data from mobile devices underscores the high-value impact of leaving known vulnerabilities unaddressed.",[168,169,170,171,172,173,174],"CIS Control 7: Continuous Vulnerability Management","NIST SP 800-53 SI-2: Flaw Remediation","ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities","OWASP A06:2021 Vulnerable and Outdated Components","NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control","NIS2 Article 21(2)(b)","MITRE ATT&CK T1566: Phishing",{"NIS2 Article 21(2)(b)":176,"MITRE ATT&CK T1566: Phishing":177,"NIST SP 800-53 SI-2: Flaw Remediation":178,"OWASP A06:2021 Vulnerable and Outdated Components":179,"CIS Control 7: Continuous Vulnerability Management":180,"ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities":181,"NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control":182},"NIS2 requires organisations to implement supply chain security measures including assessment of third-party service providers; auditing and monitoring embedded analytics scripts under this obligation would likely have detected the compromised analytics service before it delivered exploit payloads.","While technically a watering hole rather than phishing, APT29 relied on users visiting compromised legitimate sites — a drive-by delivery technique closely related to this ATT&CK technique family — meaning user awareness training about unexpected redirects and anomalous browser behaviour would have provided an additional layer of defence.","SI-2 requires organisations to identify, report, and remediate information system flaws in a timely manner; had victim organisations enforced patch timelines on iOS and Android endpoints, the known vulnerabilities exploited in this campaign would not have been available for targeting.","The watering hole attack was partially delivered via a compromised third-party web analytics component, directly mirroring the OWASP risk of using outdated or integrity-unverified external components that can be weaponised against end users.","The exploit chains relied entirely on n-day vulnerabilities with available patches; a continuous vulnerability management programme with enforced patch deadlines for mobile devices would have closed these attack vectors before APT29 could weaponise them.","This control mandates timely identification and remediation of technical vulnerabilities across all assets, including mobile devices; compliance would have significantly reduced the attack surface exploited by APT29's n-day exploit chains.","One of the campaign's primary goals was credential harvesting from mobile devices; strong authentication controls and credential isolation on managed endpoints would have limited the value of data obtained even if exploitation succeeded."]