[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fGO8VzCycKQ4phpveH-Ycrq8kpAdCHRjcwsUlL_rUI2g":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"framework_notes":19,"status":27,"created_at":28,"published_at":29,"article":30,"tags":34,"podcasts":47,"controls":48},"377c4a33-bb36-45c2-90ff-4b82ba961f80","apt29-poisons-web-analytics-script-in-watering-hole-attack-on-mobile-users","089c2168-e736-4837-90b2-765b16aeb2b2","APT29 Poisons Web Analytics Script in Watering Hole Attack on Mobile Users","APT29 compromised the Plerdy SEO Tracker, a third-party web analytics service, injecting malicious JavaScript that fingerprints and exploits iOS and Android visitors across any site using the script. This is a classic supply chain attack: by targeting one widely-used third-party component, attackers gained a multiplier effect, reaching potentially thousands of end users through trusted websites. The root cause is insufficient vetting, integrity verification, and monitoring of third-party scripts embedded in web properties. This matters because organisations often treat third-party analytics as low-risk, failing to apply the same security scrutiny they would to first-party code, creating a blind spot that sophisticated threat actors deliberately exploit.","**Immediate actions:**\n- Audit all third-party JavaScript dependencies currently loaded on your web properties and remove or freeze any non-essential scripts.\n- Implement Subresource Integrity (SRI) hashes for every externally hosted script so browsers reject tampered versions.\n- Deploy a Content Security Policy (CSP) header that explicitly whitelists approved script sources and blocks inline execution.\n\n**Long-term improvements:**\n- Establish a formal third-party vendor risk assessment process that includes periodic security reviews of all analytics, marketing, and tracking scripts.\n- Mirror and self-host critical third-party scripts from your own controlled infrastructure rather than loading them directly from vendor CDNs.\n- Maintain a Software Bill of Materials (SBOM) for all web assets, including third-party dependencies, to enable rapid response when a supplier is compromised.\n\n**Detection measures:**\n- Configure real-time alerting on any unexpected changes to script files or new external domains appearing in Content Security Policy violation reports.\n- Monitor endpoint and mobile device telemetry for anomalous browser-based exploitation patterns, such as unexpected redirects or privilege escalation following web browsing.",[12,13,14,15,16,17,18],"CIS Control 7: Continuous Vulnerability Management","OWASP A06:2021 Vulnerable and Outdated Components","NIST SP 800-53 SI-2: Flaw Remediation","ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities","MITRE ATT&CK T1566: Phishing","NIS2 Article 21(2)(b)","CIS Control 17: Incident Response Management",{"NIS2 Article 21(2)(b)":20,"MITRE ATT&CK T1566: Phishing":21,"NIST SP 800-53 SI-2: Flaw Remediation":22,"CIS Control 17: Incident Response Management":23,"OWASP A06:2021 Vulnerable and Outdated Components":24,"CIS Control 7: Continuous Vulnerability Management":25,"ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities":26},"NIS2 explicitly requires supply chain security measures including policies on the security of relationships with direct suppliers and service providers, directly addressing the third-party analytics script compromise vector used here.","While not email phishing, APT29 used a watering hole variant of the same delivery principle — luring victims to a compromised trusted resource — which ATT&CK categorises under web-based delivery sub-techniques relevant to this campaign.","SI-2 requires organisations to identify, report, and remediate flaws in information system components, which extends to monitoring third-party scripts for unauthorised modifications.","A tested incident response plan covering supply chain compromise scenarios would have accelerated detection and removal of the malicious script, reducing the window of exposure across affected websites.","This attack exploited trust in an unverified third-party component; OWASP A06 directly mandates integrity verification and ongoing monitoring of all externally sourced code.","Regular scanning of web properties and third-party script inventories would have identified the tampered Plerdy script before it could deliver exploits to site visitors.","A.8.8 requires timely identification and management of technical vulnerabilities in all assets, including third-party web components that could be weaponised against an organisation's users.","published","2026-11-04T15:21:24.9256+00:00","2026-11-04T15:21:24.908+00:00",{"id":7,"url":31,"slug":32,"title":33},"https:\u002F\u002Fthehackernews.com\u002F2026\u002F11\u002Fapt29-linked-hackers-hijack-web.html","apt29-linked-hackers-hijack-web-analytics-script-to-deliver-ios-and-android-expl-f4b7ff","APT29-Linked Hackers Hijack Web Analytics Script to Deliver iOS and Android Exploits",[35,41],{"id":36,"name":37,"slug":38,"description":39,"color":40},"05757c8d-6b93-4194-b35d-7359e7d33b0e","Vulnerability Management","vulnerability-management","Missing scans, no risk prioritization","#fb923c",{"id":42,"name":43,"slug":44,"description":45,"color":46},"f0c2a0af-58aa-4128-87c9-6acd30f2dc48","Supply Chain","supply-chain","Third-party risk, compromised dependencies","#8b5cf6",[],[49,53,57],{"slug":50,"name":51,"problem":52},"threat-intelligence","Threat intelligence","Attack campaigns reach your sector, suppliers or software before your team hears about them.",{"slug":54,"name":55,"problem":56},"third-party-risk-management","Third-party risk management (TPRM)","You know which suppliers could hurt you, and you hear quickly when one of them is breached.",{"slug":58,"name":59,"problem":60},"software-supply-chain","Software supply chain security","Malicious and vulnerable open-source packages are caught before they ship."]