Sekoia links mobile exploit attacks to Russia's APT29

Researchers say hackers believed linked to Russia’s Foreign Intelligence Service exploited iOS and Android flaws that had already been patched to target visitors of numerous websites, including one tied to the 250th anniversary of the US Constitution. The operation began when users visited compromised sites; injected JavaScript profiled the device and delivered one of three zero-click exploit chains, enabling the attackers to harvest browser cookies and, in some cases, Wi‑Fi passwords and full mobile data.

The assessment, made with “moderate to high confidence,” ties the intrusion set to APT29-style activity and to the Kremlin, according to Sekoia, which attributed the campaigns to targets and techniques seen in past operations.

Among the impersonated sites was america250[.]org, which the attackers used via a reverse proxy at america250[.]holiday to insert malicious JavaScript into content. Another site, theowo[.]club, proxied material from the Raffles London at The OWO, a venue near sensitive UK government sites; researchers suggested the aim could be diplomatic targeting through invitation-based spear‑phishing.

Additional injection methods included compromising a top Ukrainian gas company’s website and a Ukrainian analytics service used by thousands of sites. The same injected JavaScript was used across the chains, with DarkSword identified as one iOS exploit kit later linked to PARS Defense and other actors; Sekoia noted two additional, unnamed exploit chains in the most recent campaign.

Vulnerabilities exploited in the activity were all “n‑days”—unpatched on older device software—meaning attacks would not work on up-to-date iOS or Android. The report attributes the operation to the Kremlin‑aligned group based on target profiles and parallels with prior APT29 activity, as described by Sekoia and corroborated by Google on the DarkSword chain.