Skip to content
OriginalSign in
Image: Security Affairs

Security AffairsPierluigi Paganini

APT29 watering hole attacks target mobile users

Part of the UNC2452 story · since 1 Sep 2025

Developinglatest 2 hours ago14 articles9 outlets
1 Sep · BleepingComputer first4 Apr16 Jun28 AugNowThis article14th of 14
  • Mon 1 Sep, 19:15 UTC. BleepingComputer, first report. Amazon disrupts Russian APT29 hackers targeting Microsoft 365.
  • Fri 31 Jul, 21:50 UTC. Microsoft, its first report on the story. Midnight Blizzard Offshoot Hits Travellers With CaptiveCrunch.
  • Mon 3 Aug, 14:51 UTC. Infosecurity, its first report on the story. APT29 hijacks hotel Wi‑Fi to spy on travelers via fake updates.
  • Fri 11 Sep, 08:59 UTC. SecurityWeek, its first report on the story. Russian Hackers Used Claude to Evade Detection in Spy Campaign.
  • Wed 4 Nov, 14:30 UTC. Infosecurity. APT29 uses watering holes to target mobile devices with exploits. Cites a CVE in CISA KEV.
  • Wed 4 Nov, 15:30 UTC. The Hacker News, its first report on the story. APT29 linked to mobile watering hole campaign using exploits. Cites a CVE in CISA KEV.
  • Wed 4 Nov, 23:00 UTC. Ars Technica, its first report on the story. Sekoia links mobile exploit attacks to Russia's APT29.
  • Thu 5 Nov, 07:00 UTC. The Hacker News. CISA Adds Exploited Apple Flaw to Its KEV Catalog. Cites a CVE in CISA KEV.
  • Thu 5 Nov, 09:00 UTC. SecurityOnline, its first report on the story. APT29 watering hole campaign targets mobile users with exploits. Cites a CVE in CISA KEV.
  • Thu 5 Nov, 09:30 UTC. Security Affairs, its first report on the story. CISA adds Apple flaw linked to APT29 to its exploited list. Cites a CVE in CISA KEV.
  • Thu 5 Nov, 11:30 UTC. Security Affairs. Sekoia links APT29 to mobile watering hole attacks.
  • Thu 5 Nov, 11:30 UTC. SecurityWeek. Midnight Blizzard targets mobile devices with exploit chains. Cites a CVE in CISA KEV.
  • Thu 5 Nov, 20:30 UTC. Dark Reading, its first report on the story. APT29 watering hole campaign targets thousands of mobile users.
  • Sun 8 Nov, 14:30 UTC. Security Affairs. APT29 watering hole attacks target mobile users. This article, 14th of 14.

Security Affairs published its 603rd weekly newsletter on 8 November 2026, bringing together cybersecurity stories and links to international coverage. The roundup spans cybercrime, malware, hacking, intelligence and information warfare, and wider cybersecurity issues. It does not provide detailed findings of its own; instead, it directs readers to the original reports and statements.

Topics listed include attacks on European refrigeration systems and French blood banks, the XCPE botnet, alleged intrusions affecting South Korean banks, and security incidents involving Binance, Chainalysis and Polymarket. The newsletter also links to coverage of vulnerabilities in SonicWall, Apple, Barracuda and Android products, as well as reporting on APT29 watering-hole attacks targeting mobile users. Its international press section includes material from organisations including CISA, ENISA, the FBI, Google, Microsoft and Reuters.

How the story developed

All 14 articles
Developinglatest 2 hours ago14 articles9 outlets

14 articles from 9 outlets since 1 Sep. Picked up again today after 3 days quiet. This was the 14th report, 433 days after the first.

Now1 Sep27 Jul81524281524281524First reportBleepingComputer · 1 Sep, 19:15This article14th of 14 · day 433Exploited CVEInfosecurity · 4 Nov
  • Mon 1 Sep, 19:15 UTC. BleepingComputer, first report. Amazon disrupts Russian APT29 hackers targeting Microsoft 365.
  • Fri 31 Jul, 21:50 UTC. Microsoft, its first report on the story. Midnight Blizzard Offshoot Hits Travellers With CaptiveCrunch.
  • Mon 3 Aug, 14:51 UTC. Infosecurity, its first report on the story. APT29 hijacks hotel Wi‑Fi to spy on travelers via fake updates.
  • Fri 11 Sep, 08:59 UTC. SecurityWeek, its first report on the story. Russian Hackers Used Claude to Evade Detection in Spy Campaign.
  • Wed 4 Nov, 14:30 UTC. Infosecurity. APT29 uses watering holes to target mobile devices with exploits. Cites a CVE in CISA KEV.
  • Wed 4 Nov, 15:30 UTC. The Hacker News, its first report on the story. APT29 linked to mobile watering hole campaign using exploits. Cites a CVE in CISA KEV.
  • Wed 4 Nov, 23:00 UTC. Ars Technica, its first report on the story. Sekoia links mobile exploit attacks to Russia's APT29.
  • Thu 5 Nov, 07:00 UTC. The Hacker News. CISA Adds Exploited Apple Flaw to Its KEV Catalog. Cites a CVE in CISA KEV.
  • Thu 5 Nov, 09:00 UTC. SecurityOnline, its first report on the story. APT29 watering hole campaign targets mobile users with exploits. Cites a CVE in CISA KEV.
  • Thu 5 Nov, 09:30 UTC. Security Affairs, its first report on the story. CISA adds Apple flaw linked to APT29 to its exploited list. Cites a CVE in CISA KEV.
  • Thu 5 Nov, 11:30 UTC. Security Affairs. Sekoia links APT29 to mobile watering hole attacks.
  • Thu 5 Nov, 11:30 UTC. SecurityWeek. Midnight Blizzard targets mobile devices with exploit chains. Cites a CVE in CISA KEV.
  • Thu 5 Nov, 20:30 UTC. Dark Reading, its first report on the story. APT29 watering hole campaign targets thousands of mobile users.
  • Sun 8 Nov, 14:30 UTC. Security Affairs. APT29 watering hole attacks target mobile users. This article, 14th of 14.
  • Known exploited CVE
  • No CVE
  • Larger: an outlet’s first report
  • Coverage over time
  • Quiet time, folded
Show all 14 articles as a list
  1. Mon 1 SepDay 01
    1. Amazon disrupts Russian APT29 hackers targeting Microsoft 36519:15 · BleepingComputer · First report

  2. Quiet for 48 weeks

    Fri 31 JulDay 3331
    1. Midnight Blizzard Offshoot Hits Travellers With CaptiveCrunch21:50 · Microsoft · Picked up again

  3. Quiet for 3 days

    Mon 3 AugDay 3361
    1. APT29 hijacks hotel Wi‑Fi to spy on travelers via fake updates14:51 · Infosecurity · Picked up again

  4. Quiet for 6 weeks

    Fri 11 SepDay 3751
    1. Russian Hackers Used Claude to Evade Detection in Spy Campaign08:59 · SecurityWeek · Picked up again

  5. Quiet for 8 weeks

    Wed 4 NovDay 4293
    1. APT29 uses watering holes to target mobile devices with exploits14:30 · Infosecurity · Exploited CVE · Picked up again · Known exploited CVE
    2. APT29 linked to mobile watering hole campaign using exploits15:30 · The Hacker News · Known exploited CVE
    3. Sekoia links mobile exploit attacks to Russia's APT2923:00 · Ars Technica
  6. Thu 5 NovDay 4306
    1. CISA Adds Exploited Apple Flaw to Its KEV Catalog07:00 · The Hacker News · Known exploited CVE
    2. APT29 watering hole campaign targets mobile users with exploits09:00 · SecurityOnline · Known exploited CVE
    3. CISA adds Apple flaw linked to APT29 to its exploited list09:30 · Security Affairs · Known exploited CVE
    Show 3 more from 5 Nov
    1. Sekoia links APT29 to mobile watering hole attacks11:30 · Security Affairs
    2. Midnight Blizzard targets mobile devices with exploit chains11:30 · SecurityWeek · Known exploited CVE
    3. APT29 watering hole campaign targets thousands of mobile users20:30 · Dark Reading

  7. Quiet for 3 days

    Sun 8 NovDay 4331
    1. APT29 watering hole attacks target mobile users14:30 · Security Affairs · Picked up again · This article, 14th of 14

Sources

CyberSIXTSignal over noise
Updated AboutDevelopersSign in