APT29 poisoned a Ukrainian analytics script

For about a week earlier this year, APT29 injected device-fingerprinting code into the tracking script of Plerdy, a Ukrainian website-analytics firm whose scripts run on thousands of mostly-Ukrainian sites. That potentially exposed anyone who loaded one of those pages on an iPhone or Android handset to the fingerprinting and exploit-delivery infrastructure, and where a device matched an unpatched target, the attacker’s infrastructure handed back one of three exploit chains. Sekoia, which is tracking the campaign, puts the potential reach at thousands of mobile users.

That Plerdy compromise was one of three delivery vectors in the same operation. The group also broke into legitimate sites directly and injected JavaScript that exposed visitors to the fingerprinting script, among them a US chemical-industry trade association, a Ukrainian gas producer, and a Bulgarian military-related organization. Where it could not get into the real site, it stood up lookalike domains and rewrote their content on the fly to carry the same code, impersonating sites including the America250 celebration page and London’s Raffles hotel.

The fingerprinting step is the clever part of the design. Rather than fire an exploit at every visitor, the injected script collected device and browser data and sent it to an APT29 command-and-control service, which decided what to return based on platform and OS or browser version. That keeps exploits off devices that would not be vulnerable, and out of the hands of researchers running patched hardware.

Every payload was an n-day against a version that had not been updated. On iOS 16.7, the chain paired CVE-2025-43529, a bug the DarkSword exploit kit had abused before, with CVE-2024-27834 to steal browser cookies. On iOS 18.5 the group delivered the full DarkSword chain, five vulnerabilities, with a payload that could pull SMS and iMessages, voicemail, WhatsApp and Telegram messages, stored passwords and authentication tokens, account credentials, call history, contacts, calendar entries, notes, and photos.

Sekoia tied the campaign to APT29 partly through remnants of a separate 2025 watering-hole operation already attributed to the group. The US government links APT29, also called Cozy Bear and Midnight Blizzard, to Russia’s SVR, and its history runs from the 2016 DNC breach through 2020 efforts to steal COVID-19 vaccine research to SolarWinds. The victimology here is messier than that record suggests. There is a focus on Ukraine and the United States, but also unrelated targets such as an Australian medical clinic, which led Sekoia to conclude that no single sectoral targeting pattern emerges and that it cannot tell whether the group had specific targets or was simply infecting as many vulnerable phones as it could.

Sekoia also found signs the exploits came from a third party, possibly a commercial surveillance vendor, with the DarkSword kit shared across the iOS chains pointing the same way. “The adoption of packaged n-day exploit chains lowers the cost and technical threshold required to conduct advanced mobile exploitation,” the team wrote, and it expects reuse of such exploits across state-sponsored groups to grow more frequent.

Two things follow from the mechanics for anyone defending a mobile fleet. Every exploit here was an n-day against a device behind on updates, and the fingerprinting gate is designed to steer chains toward those devices rather than ones that are current, so patch currency is most of the defense against this class. The delivery also rode third-party JavaScript, both an analytics vendor’s tracking script and injected code on otherwise-legitimate sites, which is a concrete argument for subresource integrity on external scripts and for keeping the count of third-party scripts on sites you run small enough to audit. For high-risk users, iOS Lockdown Mode disables much of the browser attack surface these chains rely on.