Russian hackers, identified as Midnight Blizzard, have launched a series of watering hole attacks targeting iOS and Android devices in both Europe and the United States. According to cybersecurity firm Sekoia, these attacks employed zero-click exploits to leverage n-day vulnerabilities, posing a significant threat to users by compromising their devices.
Background on Midnight Blizzard
Midnight Blizzard, also known by aliases such as APT29, Cozy Bear, and Nobelium, is alleged to operate under the Russian Foreign Intelligence Service (SVR). This group is notorious for its focus on governmental bodies, diplomatic missions, IT service providers, and non-governmental organizations, aiming to gather intelligence through sophisticated cyber operations.
The recent attacks orchestrated by Midnight Blizzard were part of an extensive watering hole campaign. They involved the compromise or replication of high-profile websites belonging to organizations in the United States, Ukraine, the Czech Republic, and Bulgaria. The hackers injected malicious JavaScript into these sites to gather data on site visitors, including browser and device configurations.
Technical Details of the Attacks
In a complex setup known as adversary-in-the-middle (AiTM), the hackers registered domains mimicking legitimate websites, such as america250.org and the Raffles London at The OWO hotel. This enabled them to insert harmful code into these sites, potentially targeting high-profile individuals, including diplomatic delegations.
The campaign also targeted a Ukrainian web analytics service called Plerdy, adding malicious code to its tracker, thus exposing numerous websites to risk. The exploit chains used by Midnight Blizzard targeted previously addressed vulnerabilities, with two chains affecting iOS devices and one focusing on Android systems.
Vulnerabilities and Exploits
Among the identified exploit chains, two targeted iOS devices. These chains utilized the DarkSword exploit kit to execute remote code and bypass Apple’s security features, enabling the theft of cookies and sensitive information. The vulnerabilities affected were patched in updates released in May 2024.
For Android devices, the attackers exploited vulnerabilities such as CVE-2026-3910 in Chrome and a Qualcomm bug, CVE-2025-27038. The payload, known as AndroSnitch, was designed to extract sensitive data like cookies, passwords, and browser history from targeted devices.
Implications and Future Outlook
Sekoia’s analysis indicates that the use of n-day exploit chains by groups like Midnight Blizzard reduces the cost and expertise necessary to perform advanced mobile device attacks. The trend of state-sponsored groups utilizing commercial surveillance vendor exploits is expected to grow, highlighting the need for robust cybersecurity measures.
This incident underscores the persistent threats posed by state-sponsored hackers and the importance of regular software updates to protect against known vulnerabilities. As these groups continue to evolve, cybersecurity efforts must also advance to safeguard against future threats.
