Sekoia ties APT29 to iPhone and Android espionage using already-patched flaws

French security firm Sekoia has attributed a smartphone espionage campaign to APT29, the group also tracked as Cozy Bear or Midnight Blizzard and widely believed to work for Russia's SVR. Targets were in Ukraine, the United States and Europe, according to a report published Wednesday.

The delivery was mostly web-based. The attackers put malicious code on legitimate websites, stood up fake copies of real ones, and compromised Plerdy, a Ukrainian web analytics service used by thousands of sites. Between late August and early September they slipped code into a tracking script served through it, which Sekoia says potentially exposed visitors to hundreds of websites, including ones tied to the Ukrainian military and drone manufacturers.

The fake sites spoofed America250 and Raffles London at The OWO, showing the real content while running code that fingerprinted visitors' devices and software versions.

On older iPhones running iOS 16, the code went after browser and app cookies. A more advanced chain against vulnerable iPhones on iOS 18.5 used a toolkit called DarkSword to pull messages, emails, passwords, contacts, photos, location history and data from WhatsApp and Telegram. On Android, the attackers exploited flaws in older Chrome versions for browsing data, cookies and saved Wi-Fi passwords.

The part worth reading twice: none of this needed a zero-day. Sekoia says all three methods leaned on vulnerabilities Apple and Google had already patched, and they don't work against fully updated devices. The attacks also didn't try to hold long-term access, just to take data and go.

Sekoia hasn't said how many phones were compromised or how much data was taken, and it isn't clear whether specific people were picked out or the campaign was opportunistic. The firm says it's working with national CERTs to find victims.

We'd treat the patching point as the actionable one. An up-to-date phone defeats every method described here.