APT29's Watering Holes Target Thousands of Mobile Users
Our summary
Sekoia researchers report that the Russian state-linked group APT29 (also known as Cozy Bear, Midnight Blizzard, or The Dukes) ran a watering-hole campaign that briefly hijacked a Ukrainian SEO/analytics firm's website and several other legitimate and spoofed sites to push device-fingerprinting code to large numbers of iPhone and Android visitors. Depending on the device's OS version, the attackers followed up with tailored exploit chains: iOS 16.7 devices were hit via CVE-2025-43529 and CVE-2024-27834 to steal browser cookies, while iOS 18.5 devices received the full five-flaw "DarkSword" chain capable of harvesting messages, credentials, call logs, contacts, and more. Victims span Ukraine, the US, and Europe, and Sekoia suspects APT29 obtained some exploits from a commercial surveillance vendor, highlighting how advanced mobile-spying tools once reserved for elite espionage are now spreading into wider state-backed operations.
Dark Reading publishes this story on its own site; we link to it rather than reprint it.
Worried this affects your company?
Discuss a security assessment of your internet-facing systems. Scope agreed before testing.