Russia-Linked Hackers Hit iOS, Android Devices With Exploit Chains via Watering Holes

Sekoia researchers say the Russian state-backed group Midnight Blizzard (aka APT29, Cozy Bear, Nobelium) ran a large watering-hole operation that planted zero-click exploit chains on compromised or spoofed websites across the US, Ukraine, Czechia and Bulgaria, including lookalike proxies for america250.org and London's Raffles at The OWO hotel, plus a supply-chain hit on the Plerdy analytics script that exposed hundreds of Ukrainian military-related sites. The campaign fingerprinted visitors' devices and then deployed three exploit chains built on already-patched n-day flaws rather than fresh zero-days. Two iOS chains combine the previously documented DarkSword kit with CVE-2024-27834 (a PAC bypass fixed in iOS/iPadOS 17.5 and related updates, now added to CISA's KEV list) to steal cookies, messages, credentials, photos and iCloud data, while an Android chain pairs Chrome's CVE-2026-3910 with Qualcomm's CVE-2025-27038 to drop the AndroSnitch stealer targeting browser cookies, passwords and Wi-Fi credentials. Sekoia warns this reuse of commercial-grade exploit packages is lowering the bar for state actors to conduct sophisticated mobile espionage against diplomats and high-profile travelers.