French cybersecurity firm Sekoia attributed a watering-hole campaign against iPhone and Android users in Ukraine, the United States and Europe to APT29, also known as Cozy Bear or Midnight Blizzard, The Record reported Nov. 5¹. The group is widely believed to operate for Russia's foreign intelligence service, the SVR¹.

Sekoia said the attackers planted malicious code on legitimate websites, built fake versions of popular sites and compromised Plerdy, a Ukrainian web analytics service, according to a report published Wednesday¹. The investigation started after researchers found malicious code on the site of an unnamed Ukrainian gas producer¹.

Similar compromises affected other organizations, including a major U.S. chemical industry trade association and a far-right European political party, The Record said, citing Sekoia¹. Fake sites included America250, an initiative marking the 250th anniversary of the United States¹.

Between late August and early September, attackers inserted malicious code into a tracking script distributed through Plerdy, potentially exposing visitors to hundreds of sites, including those tied to the Ukrainian military, special forces and makers of drones and other military equipment¹.

On older iPhones running iOS 16, the attacks sought browser and application cookies that could be used to reach online accounts¹. A more advanced chain against iPhones on iOS 18.5 could extract messages, emails, passwords, contacts, photos, location history and data from WhatsApp and Telegram, The Record said¹.

That iOS 18.5 chain used a toolkit known as DarkSword, a suspected commercial surveillance tool previously used against users in Saudi Arabia, Turkey and Malaysia, according to the report¹. On Android, the attackers exploited already patched flaws in older Google Chrome versions to steal browsing data, cookies and saved Wi-Fi passwords¹.

Unlike some spyware, the operations were designed to extract information without keeping long-term access, Sekoia said¹. All three methods used previously disclosed vulnerabilities that Apple and Google had patched before the campaign; researchers said they were not zero-days and would not work on fully updated devices¹.

Sekoia did not establish how many phones were compromised or how much data was taken¹. The company said it was working with computer emergency response teams in affected countries to identify potential victims and disrupt infrastructure¹. The Record's account did not include a response from Moscow, Apple or Google¹.