People using outdated iPhones and Android devices who visited compromised websites could have browser cookies, messaging databases, Wi-Fi passwords and other sensitive data taken without any action on their part.
Sekoia assessed with 'moderate to high confidence' that the operation was tied to Russia's Foreign Intelligence Service, a group also tracked as APT29, Cozy Bear and Midnight Blizzard. The cybersecurity firm said its assessment rested on the profiles of the targets and similarities with an earlier attack attributed to APT29.
The operation had begun months earlier. Between August 27 and September 3, 2026, the attackers compromised Plerdy, a Ukrainian web analytics service, exposing hundreds of legitimate websites and their visitors to the exploit kit.
They also placed malicious JavaScript on the websites of a Ukrainian gas producer, a US chemical industry trade association, and organisations in Czech Republic and Bulgaria. Alongside those compromises, they registered lookalike domains including america250[.]holiday and theowo[.]club, which acted as reverse proxies for legitimate sites.
America250.org belongs to a non-partisan group that includes lawmakers, business executives and at least one former member of the Trump administration. The attackers used america250[.]holiday to proxy the site.
Theowo[.]club proxied Raffles of London OWO, a luxury hotel close to the Ministry of Defence and 10 Downing Street. Ukrainian President Volodymyr Zelenskyy stayed at the hotel during a visit on October 14.
When visitors reached a compromised or proxy site, the injected JavaScript examined their device, operating system and browser version before selecting an exploit chain. The attackers had three routes into the campaign: scripts injected into legitimate web traffic, proxy domains and the compromised Plerdy service.
The exploits required no interaction from the visitor. The operation used UltimateFingerprinter, DarkSword or AndroSnitch against previously patched iOS and Android vulnerabilities. DarkSword is an iOS exploit kit that Google researchers said had been used by customers of PARS Defense and at least two other threat actors.
Sekoia discovered the operation in mid-October 2026 after finding malicious JavaScript in the website template of the Ukrainian gas producer. The stolen material could include browser cookies, messaging app databases, Keychain credentials, location data and Wi-Fi passwords.
All the flaws used in the campaign were 'n-days', meaning they had already been fixed and could be exploited only on outdated iOS or Android versions. Sekoia said 'a user running an up-to-date operating system is safe from these attacks.'
The payloads were designed for intelligence collection rather than persistence on an infected device. Rebooting could stop the activity, although another visit to a compromised site could trigger a fresh infection.
Sekoia contacted 25 providers and hosting companies to remove malicious domains and internet protocol addresses connected with the campaign. It also worked with CERTs in affected countries, including CERT-UA, to identify victims and disrupt the infrastructure.
Comments (0)