hacker-news · Crawled Nov 5, 2026
APT29-Linked Hackers Hijack Web Analytics Script to Deliver iOS and Android Exploits
3 IoCs 1 Actors 1 Malware 4 CVEs
Read original article ↗
AI Summary
APT29, a Russia-linked threat actor, is conducting a large-scale watering hole campaign dubbed Poisoned Source, targeting iOS and Android users through compromised websites, fake domains, and a supply chain attack on the Ukrainian web analytics service Plerdy SEO Tracker. The attack delivers platform-specific exploit chains: DarkSword for iOS and AndroSnitch for Android, exploiting multiple N-day vulnerabilities to steal sensitive data including browser cookies, Wi-Fi passwords, iMessages, SMS, and device data. The campaign leverages malicious JavaScript injected into legitimate sites and lookalike domains, with exploitation triggered simply by visiting a page, requiring no user interaction.
AI-extracted · verify before operational use
Extracted Entities 6 found
Indicators of Compromise 3 extracted
MITRE ATT&CK TTPs 43 techniques
T1003 OS Credential Dumping · Credential Access T1021.001 Remote Desktop Protocol · Lateral Movement T1027 Obfuscated Files or Information · Defense Evasion T1036 Masquerading · Defense Evasion T1036.005 Match Legitimate Name or Location · Defense Evasion T1053.005 Scheduled Task · Execution T1055 Process Injection · Defense Evasion T1055.001 Dynamic-link Library Injection · Defense Evasion T1056.001 Keylogging · Collection T1056.002 GUI Input Capture · Collection T1059.001 PowerShell · Execution T1059.003 Windows Command Shell · Execution T1059.004 Unix Shell · Execution T1068 Exploitation for Privilege Escalation · Privilege Escalation T1070.004 File Deletion · Defense Evasion T1070.006 Timestomp · Defense Evasion T1071.001 Web Protocols · Command And Control T1071.004 DNS · Command And Control T1078 Valid Accounts · Defense Evasion T1090 Proxy · Command And Control T1105 Ingress Tool Transfer · Command And Control T1110 Brute Force · Credential Access T1133 External Remote Services · Persistence T1136.001 Local Account · Persistence T1185 Browser Session Hijacking · Collection T1189 Drive-by Compromise · Initial Access T1190 Exploit Public-Facing Application · Initial Access T1204.001 Malicious Link · Execution T1204.002 Malicious File · Execution T1222.002 Linux and Mac File and Directory Permissions Modification · Defense Evasion T1480 Execution Guardrails · Defense Evasion T1495 Firmware Corruption · Impact T1556 Modify Authentication Process · Credential Access T1558 Steal or Forge Kerberos Tickets · Credential Access T1566 Phishing · Initial Access T1566.001 Spearphishing Attachment · Initial Access T1570 Lateral Tool Transfer · Lateral Movement T1586 Compromise Accounts · Resource Development T1588 Obtain Capabilities · Resource Development T1595.002 Vulnerability Scanning · Reconnaissance T1659 Content Injection · Initial Access T1684.001 T1684.001 T1203 Exploitation for Client Execution · Execution