Russian government hackers found using exploits made by spyware companies NSO and Intellexa

Google’s Threat Analysis Group discovered a watering hole campaign (Nov 2023–Jul 2024) that served exploits on Mongolian government websites to compromise iPhone (Safari) and Android (Chrome) users and steal browser-stored cookies, enabling account access. Google links the activity to APT29 and notes the exploit code matches or closely resembles exploits previously developed by commercial spyware vendors Intellexa and NSO Group; unpatched devices were at risk while Lockdown Mode and timely patching mitigated impact.