[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fN5IE5LkdUdb1I_y-r5VKJ8WmiTEmAtoA8-lsNotPJa4":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"framework_notes":19,"status":27,"created_at":28,"published_at":29,"article":30,"tags":34,"podcasts":47,"controls":48},"f541a6bf-9faf-40b3-995d-abd4c268c32c","apt29-weaponizes-trusted-websites-and-analytics-services-to-target-mobile-users","30d69caa-ee6d-466c-86ec-904539d87246","APT29 Weaponizes Trusted Websites and Analytics Services to Target Mobile Users","APT29 exploited the implicit trust users place in legitimate websites by compromising them directly and infiltrating a widely-used third-party analytics service (Plerdy), effectively turning trusted infrastructure into a malware distribution network. This multi-vector watering hole campaign demonstrates how supply chain compromise can silently extend a threat actor's reach to thousands of downstream sites without those site owners taking any direct action. The targeting of mobile users is particularly significant, as mobile devices often have fewer endpoint controls and users are less likely to scrutinize URLs or certificate details on small screens. Organizations that embedded Plerdy's analytics script inherited the risk without knowledge, illustrating that third-party dependencies are an often-overlooked attack surface. This matters because even security-conscious users visiting legitimate, known-good websites could be silently compromised.","**Immediate actions:**\n- Audit all third-party scripts and analytics services embedded on your websites and remove or sandbox any that cannot be verified as uncompromised.\n- Enable Subresource Integrity (SRI) hashes on all externally loaded JavaScript to ensure third-party scripts cannot be silently modified.\n\n**Long-term improvements:**\n- Implement a formal Third-Party Risk Management (TPRM) program that continuously evaluates the security posture of all vendors supplying embedded code or analytics services.\n- Enforce a strict Content Security Policy (CSP) on all web properties to restrict which external domains are permitted to load scripts.\n- Establish mobile device management (MDM) policies that enforce browser security controls and restrict access to uncategorized or newly registered domains.\n\n**Detection measures:**\n- Deploy web application monitoring and file integrity tools that alert on unauthorized changes to website content or injected scripts.\n- Monitor outbound network traffic from mobile endpoints for anomalous connections to newly registered or low-reputation domains consistent with watering hole redirect chains.",[12,13,14,15,16,17,18],"CIS Control 15: Service Provider Management","NIST SP 800-53 SI-2: Flaw Remediation","MITRE ATT&CK T1566: Phishing","ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities","NIS2 Article 21(2)(b)","CIS Control 14: Security Awareness and Skills Training","NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control",{"NIS2 Article 21(2)(b)":20,"MITRE ATT&CK T1566: Phishing":21,"NIST SP 800-53 SI-2: Flaw Remediation":22,"CIS Control 15: Service Provider Management":23,"CIS Control 14: Security Awareness and Skills Training":24,"ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities":25,"NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control":26},"NIS2 explicitly requires covered entities to address supply chain security risks; the compromise of Plerdy to inject malicious payloads into thousands of dependent websites is precisely the upstream supply chain incident NIS2 Article 21(2)(b) mandates organizations to guard against.","The creation of fake cloned websites (e.g., a luxury hotel near UK government buildings) mirrors spearphishing site techniques designed to harvest credentials or deliver payloads to targeted individuals such as diplomatic delegations.","Compromised websites and the analytics supply chain likely involved unpatched or misconfigured components; SI-2 mandates timely identification and remediation of flaws in both internal systems and third-party software dependencies.","APT29 compromised the Plerdy third-party analytics service to reach thousands of downstream websites; CIS Control 15 requires organizations to inventory and assess the security of all external service providers supplying code or services that touch their environment.","Mobile users were specifically targeted because they are less likely to detect suspicious redirects or script injections; training users to recognize watering hole indicators and apply skepticism on mobile browsers would reduce the effectiveness of this campaign.","Infiltration of the Plerdy analytics service represents a technical vulnerability in the software supply chain; A.8.8 requires organizations to evaluate and manage vulnerabilities in all technology, including third-party components integrated into their services.","Attackers compromised legitimate website credentials to inject malicious content; enforcing strong authentication and least-privilege access controls for website administrators and analytics platform accounts would have limited the attacker's ability to modify site content.","published","2026-11-05T11:23:41.139223+00:00","2026-11-05T11:23:41.124+00:00",{"id":7,"url":31,"slug":32,"title":33},"https:\u002F\u002Fsecurityaffairs.com\u002F202473\u002Fapt\u002Frussian-apt29-targets-mobile-users-with-watering-hole-attacks.html","russian-apt29-targets-mobile-users-with-watering-hole-attacks-291326","Russian APT29 Targets Mobile Users with Watering Hole Attacks",[35,41],{"id":36,"name":37,"slug":38,"description":39,"color":40},"7261eb8f-acd4-4d93-a489-7fdd652ec0ea","Security Awareness","security-awareness","Phishing, social engineering, human error","#22c55e",{"id":42,"name":43,"slug":44,"description":45,"color":46},"f0c2a0af-58aa-4128-87c9-6acd30f2dc48","Supply Chain","supply-chain","Third-party risk, compromised dependencies","#8b5cf6",[],[49,53,57],{"slug":50,"name":51,"problem":52},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",{"slug":54,"name":55,"problem":56},"threat-intelligence","Threat intelligence","Attack campaigns reach your sector, suppliers or software before your team hears about them.",{"slug":58,"name":59,"problem":60},"dns-web-filtering","DNS filtering and secure web gateway","Users cannot reach known-malicious sites, and malware cannot phone home."]