The TDR team has identified a significant watering hole campaign targeting iPhone and Android users via hacked websites, fake look-alike domains, and a poisoned analytics service. Sekoia has a moderate to high confidence in attributing this to APT29, also known as Midnight Blizzard or Cozy Bear, a Russian group closely associated with the SVR foreign intelligence service.
Victims do not need to interact with any malicious links; merely visiting an infected page, especially if the device is not fully updated, is sufficient to initiate the attack. Chain B exploits multiple vulnerabilities, including WhatsApp and Telegram communications, Keychain passwords, Wi-Fi keys, location caches, photos, and iCloud Drive files.
APT29 Executes Zero-Day Attacks (Source: sekoia) Sekoia's attribution hinges on several key points: A partner CERT linked leftover traces from a hacked site to a private report on a 2025 APT29 operation targeting a Russian-speaking government. Unlike the previous campaign, which used a predefined list of sites, this new strategy allows for the inclusion of any cookies discovered.
This change in tactics enables attackers to reuse previously authenticated sessions, bypassing the need for passwords and allowing them to access webmail without authentication. Key indicators include static.flux-telemetry[. ]com (109.104.106[.
]107), edge-ord.clouds-stacks[. ]com, ad.starx-net[. ]com (195.58.140[. ]105), and the cookie marker VDGH_TOKEN_REF.
