State-sponsored hackers possibly connected to the Kremlin exploited previously patched security flaws in iOS and Android devices to target visitors of multiple websites, according to cybersecurity researchers. The campaign, which security firm Sekoia assessed with moderate to high confidence as tied to Russia's Foreign Intelligence Service, focused on diplomatic targets, high-profile events, and infrastructure linked to the war in Ukraine.

The attackers utilized watering hole tactics and compromised legitimate digital infrastructure to deliver malicious payloads. By relying on outdated mobile operating systems, the intrusion set sought to siphon sensitive user data, including browser cookies, Wi-Fi passwords, and full mobile device contents.

High-Profile Imposter Sites and Strategic Targets

The malicious campaign involved setting up deceptive proxy domains that mirrored legitimate websites to covertly inject JavaScript into user traffic. One notable target was america250.org, a site associated with the upcoming 250th anniversary of the signing of the US Constitution. Attackers registered the domain america250[.]holiday to act as a reverse proxy, delivering content from the genuine site embedded with malicious code. Researchers noted this setup may have been intended to establish a pretext for invitation-themed spear-phishing campaigns against high-profile national figures.

Another targeted domain, theowo[.]club, proxied the website for the Raffles of London OWO luxury hotel. Located near sensitive British government facilities such as the Ministry of Defence and 10 Downing Street, the hotel reportedly hosted Ukrainian President Volodymyr Zelenskyy during an October visit. Researchers believe this technique aimed to compromise diplomatic delegations and high-profile guests.

Infection Vectors and Zero-Click Exploits

The operation leveraged three primary methods to distribute the malicious JavaScript:

  • Direct injection of JavaScript into traffic originating from legitimate websites.
  • The use of malicious reverse-proxy domains mirroring high-profile targets.
  • A supply-chain compromise affecting a Ukrainian web analytics service utilized by thousands of sites, alongside a compromised top Ukrainian gas production company.

Once a visitor's iPhone or Android device loaded the affected page, the initial script profiled the browser and hardware platform. The attackers then deployed tailored zero-click exploit chains designed to compromise the device without requiring any user interaction. These included the DarkSword iOS exploit kit previously documented by Google researchers, alongside two additional unnamed exploit chains.

Context and Implications

Sekoia attributed the activity to the Russian group commonly tracked as APT29 based on target selection and operational similarities to past campaigns. Notably, the campaign relied strictly on "n-day" vulnerabilities—security flaws that had already received official patches from Apple and Google. Consequently, the infection attempts were only successful against mobile devices running outdated software versions.