[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fqo3t6k2oS2TanFVGV3T5zYPMj9r660CjnbD4OEYptSo":3},{"article":4,"iocs":55,"watch_terms":70,"solutions":71,"lesson":157},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":32,"category":33,"article_tags":37},"e35c3306-fbc5-4e71-b6bb-6aef5edf16cf","Russian hackers target iOS and Android users with n-day exploits","russian-hackers-target-ios-and-android-users-with-n-day-exploits-c630f4","Russia’s APT29 has been using compromised websites, lookalike domains and a hijacked web analytics service to target iOS and Android users with exploits for patched flaws and steal their cookies, messages and Wi-Fi passwords, according to Sekoia. APT29 watering holes target mobile devices with n-day exploits (Source: Sekoia) The company’s Threat Detection & Research (TDR) team spotted the operation in mid-October 2026. “This watering hole campaign, which we assess with moderate to high confidence to … More → The post Russian hackers target iOS and Android users with n-day exploits appeared first on Help Net Security.","Russian APT29, also known as Midnight Blizzard or Cozy Bear, is using compromised websites, lookalike domains, and a hijacked analytics service to deliver n-day exploits against iOS and Android users. The campaign, detected in October 2026, aims to steal cookies, messages, and Wi-Fi passwords by exploiting patched vulnerabilities. The group has targeted various organizations, including gas producers, hotels, and military sites, leveraging multiple infection vectors.","APT29 targets iOS and Android users with n-day exploits via compromised websites.","https:\u002F\u002Fwww.helpnetsecurity.com\u002F2026\u002F11\u002F04\u002Fapt29-watering-hole-mobile-devices-n-day-exploits\u002F","https:\u002F\u002Fimg.helpnetsecurity.com\u002Fwp-content\u002Fuploads\u002F2025\u002F11\u002F17085051\u002Fscam-danger-mobile.webp","2026-11-04T14:38:37+00:00","2026-11-04T15:00:29.99651+00:00",8,[17,20,22,24,27,30],{"name":18,"type":19},"APT29","threat_actor",{"name":21,"type":19},"Midnight Blizzard",{"name":23,"type":19},"Cozy Bear",{"name":25,"type":26},"Microsoft","vendor",{"name":28,"type":29},"iOS","product",{"name":31,"type":29},"Android","6cbdd207-aaa1-4176-9534-e156b125e917",{"id":32,"icon":34,"name":35,"slug":36},null,"Nation-state","nation-state",[38,40,45,50],{"category":39},{"id":32,"icon":34,"name":35,"slug":36},{"category":41},{"id":42,"icon":34,"name":43,"slug":44},"80544778-fabb-4dcd-aa35-17492e5dcf4f","Vulnerabilities","vulnerabilities",{"category":46},{"id":47,"icon":34,"name":48,"slug":49},"89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5","Malware","malware",{"category":51},{"id":52,"icon":34,"name":53,"slug":54},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[56,60,62,64,66,68],{"type":57,"value":58,"context":59},"cve","CVE-2025-43529","Used in exploit chains for iOS",{"type":57,"value":61,"context":59},"CVE-2024-27834",{"type":57,"value":63,"context":59},"CVE-2026-20700",{"type":57,"value":65,"context":59},"CVE-2025-14174",{"type":57,"value":67,"context":59},"CVE-2025-43510",{"type":57,"value":69,"context":59},"CVE-2025-43520",[25,28,31],{"controls":72,"vendors":156},[73,102,127],{"slug":74,"name":75,"problem":76,"products":77},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[78,86,94],{"vendor_slug":79,"vendor_name":80,"vendor_logo":81,"product_slug":82,"product_name":83,"url":84,"description":85},"crowdstrike","CrowdStrike","\u002Fvendor-logos\u002Fcrowdstrike.png","falcon-insight-xdr","Falcon Insight XDR","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fplatform\u002Fendpoint-security\u002Ffalcon-insight-xdr\u002F","Endpoint detection and response with extended detection across other security tools.",{"vendor_slug":87,"vendor_name":88,"vendor_logo":89,"product_slug":90,"product_name":91,"url":92,"description":93},"sophos","Sophos","\u002Fvendor-logos\u002Fsophos.png","sophos-endpoint","Sophos Endpoint","https:\u002F\u002Fwww.sophos.com\u002Fen-us\u002Fproducts\u002Fendpoint-security","Endpoint protection with Intercept X anti-ransomware technology and EDR.",{"vendor_slug":95,"vendor_name":96,"vendor_logo":97,"product_slug":98,"product_name":99,"url":100,"description":101},"elastic","Elastic","\u002Fvendor-logos\u002Felastic.png","elastic-security","Elastic Security","https:\u002F\u002Fwww.elastic.co\u002Fsecurity","SIEM and endpoint security built on Elasticsearch, with open detection rules.",{"slug":54,"name":103,"problem":104,"products":105},"Threat intelligence","Attack campaigns reach your sector, suppliers or software before your team hears about them.",[106,111,119],{"vendor_slug":79,"vendor_name":80,"vendor_logo":81,"product_slug":107,"product_name":108,"url":109,"description":110},"falcon-adversary-intelligence","Falcon Adversary Intelligence","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fplatform\u002Fthreat-intelligence\u002F","Threat intelligence on the adversaries CrowdStrike tracks, built into the Falcon platform to detect, disrupt and defend against them.",{"vendor_slug":112,"vendor_name":113,"vendor_logo":114,"product_slug":115,"product_name":116,"url":117,"description":118},"dataminr","Dataminr","\u002Fvendor-logos\u002Fdataminr.png","agentic-threat-intelligence-platform","Agentic Threat Intelligence Platform","https:\u002F\u002Fwww.dataminr.com\u002Fproducts\u002Fcyber-defense\u002Fagentic-threat-intelligence-platform\u002F","Threat intelligence platform, formerly ThreatConnect TI Ops, that collects, scores and structures intelligence and pushes it into security tools.",{"vendor_slug":120,"vendor_name":121,"vendor_logo":122,"product_slug":123,"product_name":124,"url":125,"description":126},"defused","Defused","\u002Fvendor-logos\u002Fdefused.png","defused-tf","Defused TF","https:\u002F\u002Fdefusedcyber.com\u002Fproduct\u002Ftf","Threat intelligence feed from honeypots Defused runs on several continents, showing which vulnerabilities attackers are exploiting right now, with payloads and indicators.",{"slug":128,"name":129,"problem":130,"products":131},"dns-web-filtering","DNS filtering and secure web gateway","Users cannot reach known-malicious sites, and malware cannot phone home.",[132,140,148],{"vendor_slug":133,"vendor_name":134,"vendor_logo":135,"product_slug":136,"product_name":137,"url":138,"description":139},"cloudflare","Cloudflare","\u002Fvendor-logos\u002Fcloudflare.png","cloudflare-gateway","Cloudflare Gateway","https:\u002F\u002Fwww.cloudflare.com\u002Fproducts\u002Fgateway\u002F","DNS filtering and secure web gateway.",{"vendor_slug":141,"vendor_name":142,"vendor_logo":143,"product_slug":144,"product_name":145,"url":146,"description":147},"cisco","Cisco","\u002Fvendor-logos\u002Fcisco.png","umbrella","Cisco Umbrella","https:\u002F\u002Fumbrella.cisco.com\u002F","DNS-layer security and secure web gateway delivered from the cloud.",{"vendor_slug":149,"vendor_name":150,"vendor_logo":151,"product_slug":152,"product_name":153,"url":154,"description":155},"palo-alto-networks","Palo Alto Networks","\u002Fvendor-logos\u002Fpalo-alto-networks.png","prisma-access","Prisma Access","https:\u002F\u002Fwww.paloaltonetworks.com\u002Fsase\u002Faccess","Cloud-delivered SASE: zero trust access to private apps and secure web gateway.",[],{"slug":158,"title":159,"body":160,"framework_refs":161,"framework_notes":169},"apt29-exploits-unpatched-ios-and-android-devices-via-compromised-websites","APT29 Exploits Unpatched iOS and Android Devices via Compromised Websites","Russian state-sponsored group APT29 leveraged n-day exploits — vulnerabilities that have already been patched but remain unaddressed on victim devices — to compromise iOS and Android users across multiple industries. The campaign succeeded precisely because organizations and individuals failed to apply available security patches in a timely manner, leaving known attack surfaces open. By hijacking analytics services and using lookalike domains, the attackers amplified their reach without needing zero-day capabilities. This incident underscores that patch lag, not just zero-days, represents one of the most exploited weaknesses in modern threat campaigns and can have severe consequences including theft of credentials, messages, and sensitive network data.",[162,163,164,165,166,167,168],"CIS Control 7: Continuous Vulnerability Management","NIST SP 800-53 SI-2: Flaw Remediation","ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities","OWASP A06:2021 Vulnerable and Outdated Components","MITRE ATT&CK T1566: Phishing","NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control","NIS2 Article 21(2)(b)",{"NIS2 Article 21(2)(b)":170,"MITRE ATT&CK T1566: Phishing":171,"NIST SP 800-53 SI-2: Flaw Remediation":172,"OWASP A06:2021 Vulnerable and Outdated Components":173,"CIS Control 7: Continuous Vulnerability Management":174,"ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities":175,"NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control":176},"NIS2 requires essential and important entities to implement incident handling and vulnerability management practices — the targeted gas producers and other critical sector organizations would be obligated to have patching controls that this attack circumvented.","APT29 used compromised websites and lookalike domains as infection vectors, mirroring the watering-hole and spearphishing delivery techniques catalogued under T1566, highlighting the need for user awareness and web filtering controls.","SI-2 requires organizations to identify, report, and correct information system flaws — timely application of the available iOS and Android patches would have directly prevented exploitation.","The attack relied on known, unpatched components in mobile operating systems — a textbook instance of the risk OWASP A06 addresses by requiring organizations to track and update vulnerable software components.","APT29 exploited patched but unapplied vulnerabilities; a continuous vulnerability management program with enforced patching SLAs would have eliminated the attack surface before the campaign began.","This control mandates timely identification and remediation of technical vulnerabilities; had organizations tracked and acted on the published CVEs, n-day exploitation would not have been possible.","The campaign specifically targeted session cookies to bypass authentication; strong session management controls and anomaly detection on authenticated sessions would have limited the value of stolen credentials."]