[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"post:apt29-watering-holes-hit-ios-and-android-with-zero-click-n":3},{"post":4,"author":19,"controls":26,"vendors":27,"more":28},{"slug":5,"kind":6,"title":7,"excerpt":8,"cover_image_url":9,"cover_image_alt":10,"author_name":11,"published_at":12,"body_md":13,"author_title":14,"regulation_refs":15,"ai_assisted":16,"cover_ai_generated":17,"updated_at":12,"reading_minutes":18},"apt29-watering-holes-hit-ios-and-android-with-zero-click-n","rapid-alert","APT29 watering holes hit iOS and Android with zero-click n-day exploit chains","Sekoia links a large watering hole campaign to Russia's APT29. Poisoned and cloned sites, plus a one-week compromise of the Plerdy analytics tracker, served n-day exploit chains to outdated iPhones and Android Chrome. No click needed. Update now.","https:\u002F\u002Fzbqafrnxsxwbarztrtqp.supabase.co\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fresources\u002Frapid\u002Fapt29-watering-holes-hit-ios-and-android-with-zero-click-n-e6d884f7-cover.png","APT29 WateringHole rapid alert: Phone one version behind? One page view and it's drained.","Marcus Lenngren","2026-11-05T12:57:11.234+00:00","![APT29 WateringHole rapid alert: Phone one version behind? One page view and it's drained.](https:\u002F\u002Fzbqafrnxsxwbarztrtqp.supabase.co\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fresources\u002Frapid\u002Fapt29-watering-holes-hit-ios-and-android-with-zero-click-n-e6d884f7-card.png \"The rapid alert card: save it and share it with your team\")\n\n## What happened\n\nSekoia found a large watering hole campaign in mid-October 2026 that it links, with moderate to high confidence, to Russia's APT29 (also Midnight Blizzard, Cozy Bear, tied to the SVR).\n\nVisiting a poisoned page is enough. There is no click to make, no file to open. The page loads JavaScript that profiles your device, and the attacker's server sends back an exploit chain matched to your phone and browser.\n\nThe attackers used three routes to reach victims, all leading to the same profiling script:\n\n- Direct JavaScript injection into hacked sites: a Ukrainian gas producer, a US chemical industry trade association, a far-right European political party and a Bulgarian military-related site.\n- Lookalike reverse-proxy domains, theowo[.]club and america250[.]holiday, which relayed the real content of Raffles London at The OWO (a hotel near the UK Ministry of Defence and 10 Downing Street) and the America250 site, while injecting code. Sekoia notes open-source reporting that Zelensky stayed at the hotel on 14 October.\n- A supply-chain compromise of Plerdy, a Ukrainian web analytics service loaded by thousands of sites. Between 27 August and 3 September 2026 the attackers altered its tracker file, so every site loading it also loaded their script.\n\nThe profiling script, UltimateFingerprinter, hides inside a minified AngularJS copy that makes up about 98 percent of a 2.3 MB file. It runs 61 collectors building 394 data fields, but mostly blocks only odd devices.\n\n## Timeline\n\n- 27 Aug to 3 Sep 2026: Plerdy tracker serves the injection.\n- 14 Oct 2026: Zelensky reportedly stays at the cloned hotel.\n- mid-Oct 2026: Sekoia spots the campaign.\n- 4 Nov 2026: CISA adds CVE-2024-27834 to its KEV catalog, with a two-week fix deadline for federal agencies.\n\n## Am I affected?\n\nThe exploits only hit outdated phones. Sekoia stresses that a device running an up-to-date OS is safe from these attacks.\n\n- iOS Class A targets iOS 16.7 and steals Safari cookies, using CVE-2025-43529 and CVE-2024-27834.\n- iOS Class B (the DarkSword kit) targets iOS 18.5 and takes almost everything: messages, WhatsApp and Telegram databases, Keychain passwords, contacts, location, photos and iCloud Drive. It chains CVE-2025-43529, CVE-2026-20700, CVE-2025-14174, CVE-2025-43510 and CVE-2025-43520.\n- Android Class C targets Chrome versions 139 to 145, except 143, using CVE-2026-3910 (Chrome) and CVE-2025-27038 (Qualcomm Adreno driver). The AndroSnitch payload takes Chrome cookies, logins, history and Wi-Fi passwords.\n\nAll stolen data goes to ad.starx-net[.]com. No payload persists, so a reboot stops the running activity, but anything already exfiltrated is gone.\n\n## What to do now\n\n1. Update every iPhone to the latest iOS and every Android to the latest Chrome. Apple and Google have patched all the flaws used here, with fixes backported to older iOS releases.\n2. Replace phones that no longer receive updates.\n3. Treat stolen cookies as live. Rotate credentials and force re-authentication for webmail and other sessions on any device that may have been exposed, especially for diplomats, military and defence staff.\n4. Block the IoC domains and IPs at your DNS and proxy: static.flux-telemetry[.]com, edge-ord.clouds-stacks[.]com, ad.starx-net[.]com, theowo[.]club, america250[.]holiday, adsprism-stat[.]com.\n5. Review who loads third-party scripts on sites you run, and confirm your Plerdy tracker and other analytics files have not been altered.\n\n## How to hunt\n\n- Search proxy, DNS and SIEM logs for the delivery and exfiltration domains and IPs above (195.58.140[.]105 on port 8881, path \u002Ftelemetry\u002Fv12).\n- Look for connections to the listed Shock Hosting (AS395092) and servinga (AS219399) infrastructure.\n- Match the SHA-256 hashes for the Class A, B and C stages and AndroSnitch against mobile forensic captures in VirusTotal or MISP.\n- Check for traffic from military, defence or diplomatic users to any Plerdy-loaded site during 27 August to 3 September 2026.\n\n## What does not help\n\n- A reboot alone. It ends the session but does not undo stolen data or invalidate cookies.\n- Assuming you are safe because nothing was installed. These chains do not persist by design; the theft is the point.\n\n## Sources\n\n- [Russian APT29 Hackers Turn Trusted Websites Into Traps to Compromise iPhone and Android Users](https:\u002F\u002Fcybersecuritynews.com\u002Frussian-apt29-hackers\u002F), Cyber Security News, 4 Nov\n- [Russian APT29 Targets Mobile Users with Watering Hole Attacks](https:\u002F\u002Fsecurityaffairs.com\u002F202473\u002Fapt\u002Frussian-apt29-targets-mobile-users-with-watering-hole-attacks.html), Security Affairs, 5 Nov\n- [Russia-Linked Hackers Hit iOS, Android Devices With Exploit Chains via Watering Holes](https:\u002F\u002Fwww.securityweek.com\u002Frussia-linked-hackers-hit-ios-android-devices-with-exploit-chains-via-watering-holes\u002F), SecurityWeek, 5 Nov\n- [Hackers use n-day exploits in zero-click attacks on iOS, Android devices](https:\u002F\u002Fwww.bleepingcomputer.com\u002Fnews\u002Fsecurity\u002Fhackers-use-n-day-exploits-in-zero-click-attacks-on-ios-android-devices\u002F), BleepingComputer, 4 Nov\n- [APT29-Linked Hackers Hijack Web Analytics Script to Deliver iOS and Android Exploits](https:\u002F\u002Fthehackernews.com\u002F2026\u002F11\u002Fapt29-linked-hackers-hijack-web.html), The Hacker News, 4 Nov\n- [Russian hackers target iOS and Android users with n-day exploits](https:\u002F\u002Fwww.helpnetsecurity.com\u002F2026\u002F11\u002F04\u002Fapt29-watering-hole-mobile-devices-n-day-exploits\u002F), Help Net Security, 4 Nov\n",null,[],true,false,3,{"name":11,"slug":20,"same_as":21,"job_title":22,"photo_url":23,"short_bio":24,"linkedin_url":25},"marcus-lenngren",[],"Founder, ThreatNoir","https:\u002F\u002Fzbqafrnxsxwbarztrtqp.supabase.co\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fresources\u002Fauthors\u002Fmarcus-lenngren-ca3a2dad9da5.jpg","Founder of ThreatNoir. Security and technology leader: CTO and CISO in a regulated industry, head of applications, network and data centre at Schibsted Sverige, and today security engineering for a global retailer's SOC. CISSP, CISM and AAISM.","https:\u002F\u002Fwww.linkedin.com\u002Fin\u002Fmarcuslenngren",[],[],[29,36,43],{"slug":30,"kind":6,"title":31,"excerpt":32,"cover_image_url":33,"cover_image_alt":34,"author_name":11,"published_at":35,"reading_minutes":18},"check-point-gaia-under-attack-php2shell-chained-to-root-for","Check Point Gaia under attack: PHP2Shell chained to root for ESXi wiper, patch now","Attackers are chaining PHP2Shell (CVE-2026-109618\u002F9) with a DynamicCLI root flaw (CVE-2026-123039) on Check Point Mobile Access gateways, then wiping VMware ESXi hosts. Patch and hunt tonight.","https:\u002F\u002Fzbqafrnxsxwbarztrtqp.supabase.co\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fresources\u002Frapid\u002Fcheck-point-gaia-under-attack-php2shell-chained-to-root-for-05b9bf1d-cover.png","Check Point Gaia rapid alert: Mobile Access portal exposed? One chain and your ESXi is wiped.","2026-11-13T11:18:49.874+00:00",{"slug":37,"kind":6,"title":38,"excerpt":39,"cover_image_url":40,"cover_image_alt":41,"author_name":11,"published_at":42,"reading_minutes":18},"4everable2shell-n-central-hotfix-2-servers-taken-to-root","4EverAble2Shell: N-central Hotfix 2 Servers Taken to Root Hours After PoC Dropped","A new N-able N-central exploit chain, 4EverAble2Shell, gives unauthenticated root on servers running the latest Hotfix 2. Attackers began mining within hours of the PoC, hitting 21 servers, 19 of them patched. Disable Legacy API and take on-prem N-central offline now.","https:\u002F\u002Fzbqafrnxsxwbarztrtqp.supabase.co\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fresources\u002Frapid\u002F4everable2shell-n-central-hotfix-2-servers-taken-to-root-68758f4e-cover.png","N-central HF2 rapid alert: Patched N-central to Hotfix 2? Root on the box running your clients.","2026-11-13T08:52:08.367+00:00",{"slug":44,"kind":6,"title":45,"excerpt":46,"cover_image_url":47,"cover_image_alt":48,"author_name":11,"published_at":49,"reading_minutes":18},"citrus-ransomware-abuses-group-policy-to-push-sn00py-and","Citrus ransomware abuses Group Policy to push Sn00py and disable Microsoft Defender across domains","Citrus, a newly documented crew tracked by Securelist, uses stolen contractor logins to reach a domain controller, then builds a malicious GPO named Kaspersky GPO that drops Sn00py ransomware and turns off Defender on every joined machine.","https:\u002F\u002Fzbqafrnxsxwbarztrtqp.supabase.co\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fresources\u002Frapid\u002Fcitrus-ransomware-abuses-group-policy-to-push-sn00py-and-fb0efdd6-cover.png","Citrus Ransomware rapid alert: Your DC pushes GPOs to everyone? One policy kills Defender domain-wide.","2026-11-12T08:02:16.435+00:00"]