Russian Intelligence Targets Mobile Devices in Watering Hole Campaign
Russian state hackers, identified as APT29/Cozy Bear, are conducting a sophisticated watering hole campaign against iOS and Android users to steal browser cookies and sensitive data.
Cybersecurity firm Sekoia has attributed a large-scale watering hole campaign targeting mobile devices with high confidence to Russia's Foreign Intelligence Service, also known as APT29, Cozy Bear, and Midnight Blizzard. The campaign, detected in mid-October, leverages compromised and lookalike websites to exploit known, unpatched vulnerabilities in iOS and Android devices, aiming to steal browser cookies and other sensitive information.
The campaign's targets appear diverse, including a Ukrainian gas production firm, a U.S. chemical trade association, America250, and a Bulgarian military organization. Additionally, the attackers compromised a Ukrainian third-party web analytics service, Plerdy, to expand their reach. Sekoia researchers noted that the scattered nature of the compromised websites is typical for watering hole attacks, where the true objective is to ensnare specific individuals by compromising sites they are known to visit.
Attackers employed two primary methods for payload delivery: injecting malicious JavaScript into legitimate websites or setting up phishing domains that function as reverse proxies for high-profile sites. The exploitation of known, already-patched vulnerabilities indicates a focus on users with outdated mobile operating systems and applications, making them susceptible to these attacks.
Sekoia's investigation was aided by the threat actor's reuse of the same malicious JavaScript filename across different infection vectors. This consistent naming convention allowed researchers to identify additional delivery servers controlled by the attackers. By utilizing internet indexing and scanning platforms like URLScan, Censys, and Shodan, Sekoia was able to link a significant number of victims back to a unified attack infrastructure.
Further corroboration for the attribution came from a joint investigation with Ukraine's CERT-UA and an unnamed partner organization. Traces found on one of the compromised websites matched a previous watering hole campaign linked to the same Russian group in 2025. This historical link, combined with the threat actor's Tactics, Techniques, and Procedures (TTPs) aligning with a 2024 APT29 campaign against the Mongolian government reported by Google TAG, strengthens the attribution.
The campaign's objective is purely intelligence collection, rather than establishing persistence on compromised devices. The stolen browser authentication cookies can grant attackers access to corporate webmail, cloud collaboration suites, and internal web portals without requiring passwords or bypassing multi-factor authentication. This access serves as a critical stepping stone for further intrusions, including identity and cloud-based compromises.
Beyond cookies, the attackers also aim to collect social media and text messaging logs and contacts, which can be used for sophisticated spear-phishing operations. Other stolen secrets could lead to full account takeovers or provide network-level access to target systems. Sekoia has initiated takedown requests with 25 hosting providers and companies to disrupt the malicious domains and IP addresses associated with this campaign.