Security researchers identified a campaign in which attackers assessed to be associated with Russia’s Foreign Intelligence Service exploited previously patched security flaws in iOS and Android operating systems. The campaign targeted visitors to multiple websites through various infection methods, including direct code injection into web traffic, fraudulent proxy domains, and compromised web services.
Among the sites impersonated were america250.org, associated with a nonpartisan group organizing celebrations for the United States’ 250th anniversary, and a luxury hotel in London located near sensitive UK government facilities. Researchers from security firm Sekoia assessed that the attackers may have deliberately selected these targets to facilitate spear-phishing campaigns against high-profile individuals and diplomatic delegations.
The attackers employed three primary distribution vectors: injecting malicious code into legitimate website traffic, creating proxy domains that mirrored real sites, and compromising a Ukrainian web analytics service used by thousands of websites. Once users accessed compromised sites, JavaScript code would profile their devices and deliver tailored exploit chains designed to steal browser data, Wi-Fi passwords, and other mobile device information.
The exploitation chains utilized were zero-click exploits, meaning they functioned without requiring any action from targets. One identified chain was DarkSword, an iOS toolkit previously used by commercial surveillance vendors and other threat actors. Sekoia stated that the campaign employed two additional unnamed exploit chains.
All vulnerabilities exploited in the campaign had been previously patched by device manufacturers, meaning successful attacks only affected users running outdated software versions. Researchers attributed the campaign to the suspected Russian group based on target selection patterns and similarities to previous operations tracked under the designation APT29.
Article Attribution | Read More at Article Source
Article summary produced by Claude AI