Google: apparent Russian hackers play copycat to commercial spyware vendors

Google’s Threat Analysis Group reported that suspected APT29 actors conducted watering‑hole campaigns against Mongolian government websites from November through July, using n‑day exploits identical or very similar to 0‑day exploits previously employed by commercial spyware vendors (Intellexa, NSO). The analysis underscores concerns that exploits developed in the commercial surveillance industry are proliferating to dangerous state‑backed threat actors.