A Russia-linked hacking group is using known exploit chains, including one built by a suspected commercial surveillance vendor, to exploit iOS and Android n-days in a campaign focused on Ukraine.
Security firm Sekoia uncovered the latest campaign, which it attributed to APT29. The threat group, also known as Midnight Blizzard and Cozy Bear, is linked to the Foreign Intelligence Service of the Russian Federation or SVR.
The campaign, which Sekoia uncovered in mid-October, primarily uses a watering-hole technique compromising or cloning high-profile websites in the US, Ukraine, Czech Republic, and Bulgaria. In one of the infection chains, the attackers used the DarkSword exploit kit.
Since at least November 2025, multiple commercial surveillance vendors and suspected state-sponsored actors have been using DarkSword, according to Google.
Once compromised, the payloads exfiltrated browser cookies, Wi-Fi passwords or full mobile device data.
“Based on technical overlaps, operational patterns, victimology and infrastructure, we assess with moderate to high confidence that this campaign was conducted by APT29,” Sekoia said.
Poisoned websites and a hijacked tracker delivered the exploits
The hacking group is using compromised legitimate websites, adversary-in-the-middle (AitM) attacks impersonating high-profile websites, and a compromised Ukrainian web analytics service to carry out the initial infection.
All three infections deliver the same payload, a code injection that loads an external script to profile the visitor’s browser and device. The attackers then use mobile and browser versions to serve platform-specific n-day exploit chains without user interaction on unpatched devices, Sekoia said.
“A user running an up-to-date operating system is safe from these attacks,” the company added.
In the case of attacks against victims in Ukraine, the hacking group compromised a domain associated with Plerdy analytics tracker that is used by thousands of downstream websites between Aug. 27 and Sept. 3.
Of the websites it compromised directly, Sekoia said: “We assess that these websites may have been selected to profile and infect specific individuals of interest based on targeting intelligence to which we do not have visibility.”
On iOS, one chain reused DarkSword’s initial exploit with a separate Pointer Authentication bypass to steal cookies, while the full DarkSword chain harvested device data, including iMessage and mail indexes.
iOS vulnerabilities exploited by the hackers include CVE-2025-43529 and CVE-2024-27834 for cookie theft, and CVE-2025-43529 and CVE-2026-20700, among others, for device data collection.
To target Android devices, the hackers exploited CVE-2026-3910 and CVE-2025-27038.
“We assess that the proliferation and reuse of [commercial surveillance vendor] exploits among state-sponsored intrusion sets will likely become more frequent,” the company added.
