APT29 Fingerprints Thousands via Compromised Websites

APT29, the Russian state-sponsored intelligence group, ran a coordinated watering-hole campaign to distribute device-fingerprinting malware targeting iOS and Android users. The group compromised legitimate websites including those of a US chemical trade association, Ukrainian energy producer, and Bulgarian military organization. When unable to breach real sites, APT29 created lookalike domains impersonating entities like America250 and Raffles hotel. The campaign also leveraged a supply-chain compromise of Plerdy, a Ukrainian analytics service used by thousands of websites, exposing visitors across those properties to the same malicious code.

The fingerprinting malware collected device and browser data before delivering platform-specific exploit chains targeting unpatched vulnerabilities. iOS 16.7 devices encountered exploits using CVE-2025-43529 and CVE-2024-27834 to steal browser cookies, while iOS 18.5 systems received the full DarkSword exploit kit—five chained vulnerabilities capable of exfiltrating SMS, WhatsApp and Telegram messages, stored passwords, call history, photos, and other sensitive personal data. Most victims were Ukrainian organizations, with additional targets across Europe and the US.

Researchers suspect APT29 obtained the DarkSword exploits from a commercial surveillance vendor rather than developing them internally. This procurement pattern indicates sophisticated mobile intrusion tools are proliferating beyond targeted espionage operations. As packaged exploit chains become more widely available and reused across state-sponsored groups, large-scale mobile surveillance capabilities are likely to accelerate and expand.