Sekoia reports a watering-hole campaign that served exploit chains to iPhone and Android visitors of legitimate sites, and assesses with moderate to high confidence that APT29 (Midnight Blizzard, widely attributed to Russia’s SVR) is behind it. Sekoia’s report is dated 4 November 2026. The exploits target bugs that vendors patched long ago, so a fully updated device is not exposed. Sekoia notes the attribution could point to APT29 or one of its subgroups.
What Sekoia found
Per Sekoia, the operators modified the JavaScript served by a.plerdy[.]com, the tracker of a Ukrainian SEO analytics service, for about a week (27 August to 3 September 2026). The changed file loaded a fingerprinting script and redirected visitors through edge-ord.clouds-stacks[.]com, which Sekoia assesses with moderate confidence was used as a load balancer sending requests on to other delivery servers. Sekoia says thousands of mostly Ukrainian sites embed the tracker, some linked to the defence sector and military recruitment.
Separately, the actors compromised sites directly in the US, Ukraine, the Czech Republic and Bulgaria. Sekoia lists a Ukrainian gas production company, a US chemical industry trade association, a far-right European political party and a Bulgarian military-related site. It also found lookalike reverse-proxy domains themed on America250 (the US 250th anniversary) and Raffles London at The OWO, which it suggests could support invitation-themed spear-phishing and the targeting of diplomatic delegations and high-profile guests. That motive is Sekoia’s inference.
Sekoia describes three exploit classes, all n-days:
- iOS 16.7: steals cookies, using CVE-2025-43529 and CVE-2024-27834.
- iOS 18.5: full device data theft, built on the DarkSword toolkit, using CVE-2025-43529, CVE-2026-20700, CVE-2025-14174, CVE-2025-43510 and CVE-2025-43520.
- Android Chrome 139 to 145 (excluding 143): steals Chrome data and Wi-Fi passwords, using CVE-2026-3910 and CVE-2025-27038.
KEV status
We checked the CISA KEV feed (version 2026.11.04). CVE-2024-27834, an Apple pointer authentication bypass that requires an attacker with arbitrary read and write capability, was added on 4 November with a due date of 18 November. The other seven distinct CVEs named above were already listed (CVE-2025-43529 appears in two chains). NVD scores CVE-2024-27834 at 5.5 (Primary, local vector), and per NVD Apple fixed it in iOS 16.7.8, iPadOS 16.7.8, iOS and iPadOS 17.5, macOS Sonoma 14.5, Safari 17.5, tvOS 17.5 and watchOS 10.5 (May 2024). The CISA entry does not mention Sekoia or APT29, but NVD’s reference list for this CVE now includes the Sekoia report, so the connection to this campaign is plausible; CISA has not stated it.
What it means
Sekoia’s attribution rests on a partner’s private report, a Google TAG observation that the framework resembles a 2024 APT29 watering hole against Mongolian government sites, and victimology; we found no independent public corroboration. Sekoia began investigating in mid-October 2026, weeks after the Plerdy window closed.
Our assessment: the notable point is the delivery route. Compromising a third-party analytics script gives an actor reach into every site that embeds it, including organisations that would never be targeted directly. In our view, mobile browsers are rarely covered by the controls enterprises apply to laptops.
Sekoia says no single sectoral pattern emerges from the victims and that unrelated entities, such as an Australian medical clinic, complicate a strategic reading; it says some sites may have been compromised to reach specific individuals (low confidence). The named victims include a gas producer and a chemical trade association, which is why we tag critical infrastructure. Sekoia is coordinating with national CERTs on victim identification, and says some indicators are withheld and shared under TLP:AMBER.
Recommended actions
- Confirm managed iOS and Android devices run current OS and Chrome versions. Class A targets iOS 16.7; the CVE-2024-27834 fix for that line is iOS 16.7.8 per NVD, and we have not confirmed which build closes every Class A CVE, so check Apple’s advisories.
- Where devices cannot update, restrict browsing or retire them from sensitive roles.
- Inventory third-party scripts on your own sites, apply Subresource Integrity or self-host where practical, and monitor for unexpected changes to tracker files.
- Block or alert on the domains named in the report. Sekoia withholds other delivery and exfiltration hosts, which it shares under TLP:AMBER with national CERTs and law enforcement. We have not independently verified the indicators.
- Organisations in the countries Sekoia names should contact their national CERT.
CISA lists known ransomware use of CVE-2024-27834 as “Unknown”. The campaign details above rest on a single source, Sekoia.