Exploited vulnerabilities · Briefing
APT29-linked campaign used Plerdy scripts to target unpatched iOS and Android devices
Researchers describe mobile exploitation delivered through compromised websites and an analytics service. Defender priority: assess phone patch coverage and possible exposure of authenticated sessions.
Kinwilder research desk · · AI-assisted analysis
What is established
Reports published on 4 November 2026 describe mobile espionage activity Sekoia discovered in mid-October 2026. Website visits could trigger exploitation without further interaction. Delivery sites included Ukrainian gas and military organisations, a US chemical-industry association, a Czech far-right movement and a Bulgarian military-related site. These describe website exposure, not confirmed device victims. Infosecurity Magazine
The reported Plerdy analytics compromise ran from 27 August to 3 September 2026. Alongside scripts inserted directly into websites and lookalike domains, it delivered browser and device profiling followed by platform-specific exploitation. The Hacker News
For iOS 16.7, researchers identified CVE-2025-43529 and CVE-2024-27834 in a cookie-theft chain. For iOS 18.5, the DarkSword chain used CVE-2025-43529, CVE-2026-20700, CVE-2025-14174, CVE-2025-43510 and CVE-2025-43520 for broader data theft. Every flaw had fixes before the campaign began. Help Net Security
The Android chain targeted Chrome 139–145, excluding 143, using CVE-2026-3910 and CVE-2025-27038. The Hacker News
Immediate implication — analysis: defenders should assess phone patch coverage and potentially exposed work sessions together.
Who is behind it
Sekoia assessed with moderate to high confidence that APT29, or one of its subgroups, was responsible. Infosecurity Magazine lists Midnight Blizzard and Cozy Bear as aliases and describes the group as widely attributed to Russia’s Foreign Intelligence Service. Infosecurity Magazine
Attribution interpretation — analysis: that is a qualified activity attribution and state association; it does not establish operators’ physical location. DarkSword names an exploit kit, not a separate attributed operator.
Our analysis
Kinwilder analysis: the attack crossed two trust boundaries. Website owners delegated script execution to an analytics supplier; visitors then trusted pages whose dependencies could change independently. Browser exploitation attempted to cross the next boundary, from processing website content into access to protected device data.
The authorization invariant is straightforward: permission to measure page visits must not confer permission to read a visitor’s messages or authenticated sessions. A familiar website address cannot establish that every script it loads remains trustworthy.
Likely exposure therefore depends on both delivery and susceptibility. Organisations should ask which phones visited affected pages, what software those phones actually ran, and which accounts were accessible from them. Website exposure alone cannot answer whether a device was compromised.
Watch for evidence that narrows this intersection: additional delivery periods, confirmed device findings and supplier remediation details. These would be more useful than treating every visitor as a proven victim.
Defensive actions
Kinwilder recommendations — analysis: prioritise the following work. Sekoia’s reported assessment makes updating the central preventive action: the campaign used previously fixed flaws. Help Net Security
- Verify deployed patches. Check actual operating-system, browser and device security-update status through management records. The packet names targeted versions but supplies no fixed release numbers; use the relevant vendor advisories to establish supported remediation builds.
- Reconstruct exposure. Review retained DNS, proxy and mobile-security telemetry against the reported delivery period. The Hacker News identifies a collection destination on
ad.starx-net[.]com, port 8881, under/telemetry/v12. Use that as a retrospective lead, not proof by itself. The Hacker News - Investigate sessions as well as devices. Where exposure and vulnerability overlap, preserve available evidence and inspect identity-provider and application logs for unexpected session use. Revoke affected sessions and rotate potentially exposed secrets according to findings.
- Audit script dependencies. Identify which pages load analytics code, who can change those dependencies and whether unexpected changes generate alerts. Ask suppliers how they verified recovery and what customer exposure evidence they can provide.
Key concepts
Plain-language explanations: an n-day vulnerability is an already disclosed flaw; the reported chains used flaws with available fixes. A watering hole places malicious content where intended targets may browse. A session cookie can represent an existing login, making its theft relevant even without a stolen password.
Limits
The three publishers largely relay Sekoia’s investigation; they are not three independent technical confirmations. The packet establishes neither a confirmed device-victim count nor campaign-wide containment. Selection of individual targets remains uncertain. Payloads reportedly lacked persistence, which limits what a later search for installed malware can establish. Help Net Security
Kinwilder did not reproduce the exploitation or independently verify the infrastructure, attribution or supplier recovery.
Groups in this story: APT29
Kinwilder briefing: AI-written analysis of public reporting, checked in a separate AI review against the linked sources. No human expert review or independent reproduction is implied.