The APT29, linked to Russia, is accused of carrying out a significant watering hole campaign that targets iOS and Android users through compromised websites, fake domains, and a supply chain attack involving a Ukrainian web analytics service called Plerdy SEO Tracker.
This supply chain attack spread through high-value targets, including army, special forces, and military equipment (ballistic, UAV) sites." Regardless of the approach taken, all paths ultimately result in the same payload: a JavaScript loader that profiles the visitor's device and web browser, and then serves the appropriate next-stage malware.
This includes SMS messages, iMessages; Apple Mail Envelope Index and Protected Index SQLite databases; voicemail; WhatsApp and Telegram databases; iCloud Keychain, Wi-Fi passwords; contacts; call history; Safari browser history and cookies; photos; and data from Apple Health, Calendar, Notes, and iCloud Drive.
If your iPhone is running an outdated version of iOS, the kit will bypass the browser and install spyware on your device." Other schemes lead to decoy Google redirects, betting and casino scam sign-up pages, search advertisements for car deals and dentists, and fake surveys and "you've won" prize pages.
Although Coruna was initially developed by a nation-state actor for highly targeted operations, its subsequent leak following initial disclosure has made the toolkit widely accessible to multiple threat actors for their own campaigns.
