French security firm Sekoia published a report on November 5 tracing a sprawling phone-spying campaign back to the website of a Ukrainian gas production company. Russian state hackers tied to APT29, the group also known as Cozy Bear and Midnight Blizzard, planted malicious code on that site and used it as a launch point for an operation that reached users across Ukraine, the United States, and Europe. The targets included a U.S. chemical industry trade association and a far-right European political party.
The attackers did not stop at one compromised website. Between late August and early September, they inserted malicious code into a tracking script belonging to Plerdy, a Ukrainian web analytics service used by thousands of sites. Plerdy's own client list skewed toward Ukrainian military, special forces, and drone and military equipment manufacturers. A single supply chain compromise turned an ordinary traffic-counting tool into a fingerprinting system that could silently profile every visitor to hundreds of sites before deciding who was worth attacking further.
APT29 also built spoofed versions of real websites to widen the net. A fake page mimicking America250, the U.S. 250th-anniversary initiative, dangled event invitations as bait. A fake Raffles London at The OWO, built to mirror a hotel near British government buildings, appears designed to catch diplomats and VIP guests. Volodymyr Zelensky reportedly stayed at the real hotel in October. Sekoia found no evidence he was personally targeted, but the placement of the fake site tells you who the operation was built to catch.
The fingerprinting script checked each visitor's device and software version before attempting an exploit. Older iPhones running iOS 16 had their browser and app cookies stolen, handing attackers access to online accounts without needing a password. iPhones still on iOS 18.5 were hit with a more advanced tool called DarkSword, a commercial-grade surveillance kit previously used against targets in Saudi Arabia, Turkey, and Malaysia. DarkSword pulled messages, emails, passwords, contacts, photos, location history, and data from apps including WhatsApp and Telegram. Android devices running outdated Chrome had their browsing data, cookies, and saved Wi-Fi passwords lifted through known Chrome flaws.
None of this required a zero-day. Every flaw APT29 exploited had already been patched by Apple and Google. A fully updated phone visiting the same compromised sites would have walked away clean. The gap between when a patch ships and when people actually install it was the real opening, and APT29 built an entire data-theft operation to live inside that gap.
Sekoia could not determine whether APT29 was hunting specific people or vacuuming up data from anyone running old software. A watering hole attack does not need to know who you are before it decides to try you. It only needs you to show up with a device that still has last year's vulnerabilities sitting unpatched, and ordinary infrastructure, a gas company's website, a widely used analytics script, does the rest of the targeting work for free.
Sekoia is now working with national CERTs in the affected countries to identify victims and look for ways to disrupt APT29's infrastructure. That response fixes this campaign. It does not fix the underlying model. Any analytics script, ad network, or third-party widget embedded across thousands of sites is a single point of compromise waiting for the next state actor to find it.
Blackout VPN exists because privacy is a right. Your first name is too much information for us.
Keep learning
FAQ
What is APT29
APT29 is a Russian state-linked hacking group also known as Cozy Bear or Midnight Blizzard, widely believed to operate on behalf of Russia's SVR foreign intelligence service.
Did this attack use a zero-day vulnerability
No. Sekoia confirmed the campaign only exploited flaws that Apple and Google had already patched. Fully updated devices were not affected.
How did a web analytics script get used to hack phones
Attackers inserted malicious code into Plerdy's tracking script, which was already embedded on thousands of websites. The compromised script fingerprinted visitors' devices and software versions, then served exploits to the ones running outdated software.
What data did the attack steal
On older iPhones it stole browser and app cookies. On iPhones running iOS 18.5 the DarkSword toolkit pulled messages, emails, passwords, contacts, photos, and location history, plus data from apps like WhatsApp and Telegram. On Android it took browsing data, cookies, and saved Wi-Fi passwords.
How do I protect my phone from this kind of attack
Install operating system and browser updates as soon as they are available. This specific campaign only worked against devices running outdated software.