Cybersecurity researchers identified a hacking campaign they assess with moderate to high confidence was conducted by Russia’s Foreign Intelligence Service, targeting visitors to multiple websites through exploitation of previously patched mobile operating system flaws.
The campaign relied on three primary infection methods: direct injection of malicious JavaScript into web traffic from legitimate sites, the creation of proxy domains impersonating real websites, and compromise of a Ukrainian web analytics service used by thousands of websites. The injected code initially profiled the visitor’s device and browser before delivering zero-click exploit chains tailored to the platform, which operated without requiring user interaction. The payloads aimed to extract browser cookies and, depending on the attack vector, Wi-Fi passwords and comprehensive mobile device data.
Among the targeted websites was america250.org, maintained by a non-partisan group of lawmakers and business leaders focused on celebrating a national milestone. Attackers registered a lookalike domain functioning as a reverse proxy that served legitimate content while inserting malicious code. Researchers assessed the selection of this site reflected an attempt to leverage the associated high-profile national event for spear-phishing campaigns. A second impersonated website was Raffles of London OWO, a luxury hotel situated near sensitive UK government institutions, with researchers noting that targeting this property may have aimed to reach diplomatic delegations and high-profile guests.
The campaign also exploited compromised websites including a major Ukrainian energy company and a widely-used Ukrainian analytics platform. All vulnerabilities leveraged in the operation had been previously patched, meaning attacks succeeded only against devices running outdated software versions. One exploit chain identified was DarkSword, an iOS toolkit previously used by commercial surveillance vendors and other threat actors. Attribution to Russian state intelligence was supported by analysis of target selection patterns and similarities to prior campaigns associated with APT29, a tracked designation for the suspected Russian group.
Article Attribution | Read More at Article Source
Article summary produced by Claude AI