Commercial Spyware Vendors Have a Copycat in Top Russian APT

Multiple watering-hole campaigns attributed to Russian-backed APT29 targeted visitors of Mongolian government websites (cabinet.gov.mn and mfa.gov.mn), delivering n-day mobile exploits—including one tracked as CVE-2023-41993—that match earlier 0-day tooling used by commercial surveillance vendors (Intellexa and NSO), suggesting reuse or shared sourcing of exploits and active in-the-wild exploitation.