APT29 uses watering holes to target mobile users
Original title: APT29's Watering Holes Target Thousands of Mobile Users
Russian state-sponsored APT29 compromised a Ukrainian SEO site to distribute fingerprinting code to potentially thousands of iPhone and Android users.
It has emerged this week that Russia's APT29 threat group compromised the website of a Ukrainian SEO and website analytics service, and briefly used the access to distribute malicious device-fingerprinting code to potentially thousands of iPhone and Android users. The weeklong compromise earlier this year was part of a broader watering-hole campaign from APT29 (aka Cozy Bear, Midnight Blizzard, and The Dukes) that also used other legitimate and fake websites to distribute the fingerprinting malware, and later to collect sensitive personal information from selected devices.
- APT29 is linked to Russia's Foreign Intelligence Service (SVR)
- Campaign targets government agencies, diplomatic organizations, technology companies, and healthcare
- Focus on Ukraine and the United States
Impact: harvesting sensitive personal information from selected devices
- Threat actors
- APT29
- Countries
- RussiaUkraineUnited States
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| md5 | 2d76535f1200fe5e793e2dc1053b22f4 | ures-enterprise-threat#recipe=similar-items&sourcecontentid=2d76535f1200fe5e793e2dc1053b22f4) ToxicPanda Banking Trojan Matures Into Enterprise Threat |
| md5 | 922ed7dde39aba98a0ae1bdd42d08538 | tacks-north-korean-apt#recipe=similar-items&sourcecontentid=922ed7dde39aba98a0ae1bdd42d08538) FBI Flags Quishing Attacks From North Korean APT by Rob W |
| md5 | d97b5198b8378ec332c05757e8a69e80 | alware-android-devices#recipe=similar-items&sourcecontentid=d97b5198b8378ec332c05757e8a69e80) Supply Chain Attack Embeds Malware in Android Devices by |
| md5 | e171754018300438a702de2714e8cef2 | e-vendor-controlled-c2#recipe=similar-items&sourcecontentid=e171754018300438a702de2714e8cef2) Predator Spyware Sample Indicates 'Vendor-Controlled' C2 |
From the original article
8 min read at darkreading.com
After compromising websites, the Russian state-sponsored threat group is fingerprinting victims, then harvesting information from the interesting ones.
By Jai Vijayan · darkreading.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.