The cyber-espionage group APT29, linked to Russian interests, has been implicated in an expansive cyber campaign targeting mobile users. This operation uses compromised web analytics scripts to infiltrate iOS and Android devices, leveraging a supply chain attack on the Ukrainian Plerdy SEO Tracker, as detailed by researchers Amaury-Jacques Garçon and Félix Aime from Sekoia.
Complex Attack Vectors
The campaign, dubbed Poisoned Source, utilizes three main methods to execute its attacks. These include compromising legitimate websites with malicious JavaScript, creating deceptive lookalike domains of prominent websites, and injecting harmful code into Plerdy SEO Tracker’s scripts. These tactics enable the attackers to deliver platform-specific exploits designed to extract sensitive data such as browser cookies and Wi-Fi passwords.
Some of the affected sites are strategically significant, including a U.S. chemical industry association and a Bulgarian military-focused website. The campaign appears to be finely tuned to attract high-value targets amid the ongoing Russia-Ukraine conflict.
Technical Details and Exploit Mechanisms
The operation’s payloads are delivered through JavaScript loaders, which assess the visitor’s device and browser, subsequently deploying appropriate malware. On iOS, the DarkSword exploit kit targets devices to harvest comprehensive data including cookies and device information. For Android, the exploits aim to extract Chrome data and Wi-Fi credentials without sustaining persistent access.
Several classes of exploits have been identified, each targeting specific device versions and vulnerabilities. For instance, Class A focuses on iOS 16.7 using CVE-2025-43529 and CVE-2024-27834, while Class B targets iOS 18.5 with a broader exploit chain including multiple CVEs. Class C exploits Android Chrome versions 139 to 145, excluding 143.
Evolution of Exploit Kits
This campaign is part of a broader trend involving the reuse and evolution of mobile exploit frameworks like DarkSword. Recent developments include the P7 variant of DarkSword, spread through targeted advertising and expired domain tactics known as DeadTag. This exploit path affects older iPhones and relies on redirecting users to malicious sites via compromised domains.
Security firms have identified over 600 domains involved in distributing these exploit kits, illustrating the scale and sophistication of the threat landscape. The widespread availability of these tools, initially developed for nation-state use, has lowered the barrier for conducting advanced mobile exploits.
In conclusion, the APT29-led operation underscores the persistent threat posed by state-sponsored cyber activities. The ability to adapt and utilize sophisticated tools like DarkSword and Coruna signifies a continuing evolution in cyber warfare tactics, necessitating vigilant security measures and rapid response strategies.
