APT29-Linked Hackers Hijack Web Analytics Script to Deliver iOS and Android Exploits
Summary
The Russia-linked threat actor APT29 is reportedly behind a large-scale watering hole campaign targeting iOS and Android users. The attackers used compromised websites, fake domains, and a supply chain compromise of Plerdy SEO Tracker, a Ukrainian web analytics service, to inject JavaScript that collects browser and device attributes. The excerpt is truncated before full details of the exploitation chain are given.
IFF Assessment
A state-linked APT is successfully compromising mobile users at scale through a trusted third-party supply chain, which is adverse for defenders.
Defender Context
Supply chain compromises of widely embedded third-party scripts, such as analytics and tag managers, can expose many sites' visitors at once, so defenders should inventory third-party JavaScript and enforce Content Security Policy and subresource integrity. Mobile device fingerprinting and watering hole tactics targeting iOS and Android users warrant monitoring of mobile threat telemetry and browser-based indicators. Watch for further APT29 activity that mixes web-based delivery with mobile exploitation.