Russian APT29 Targets Mobile Users with Watering Hole Attacks

Sekoia reports a watering‑hole campaign attributed to APT29 that used hacked and cloned high‑profile websites plus a compromised Ukrainian web analytics service (Plerdy) to deliver mobile exploit chains against iOS and Android; the operation deployed three exploit classes (including the DarkSword iOS kit and an Android payload dubbed AndroSnitch) to harvest extensive device and account data from unpatched phones, routed exfiltration to ad.starx-net.com and used multiple delivery domains, while relying on n‑day vulnerabilities (no zero‑days) and showing supply‑chain and targeted‑reconnaissance characteristics.