Skip to content
NewA calmer, faster ZeroHour
StoryThreat actorhighExploited in the wild

APT29 watering holes fingerprint mobile users via Plerdy

2 sources · 2 articlesFirst reported Updated ()
What's new

November 5: Dark Reading adds a weeklong Plerdy compromise, SVR aliases, and government, diplomatic, technology and healthcare targeting.

Merged summary · x-ai/grok-4.7 · rewritten as coverage arrivesSummaries by Vani AI

Sekoia links APT29 to a 2026 watering-hole campaign that fingerprinted iPhone and Android visitors through compromised sites and Plerdy.

Sekoia has linked Russian state-sponsored APT29 to a mid-October 2026 watering-hole campaign against iOS and Android users. Attackers injected malicious JavaScript into high-profile sites in the United States, Ukraine, the Czech Republic and Bulgaria, used fake sites, and compromised Ukrainian analytics service Plerdy so fingerprinting code could reach visitors. Security Affairs says the Plerdy tracker was compromised between August and September 2026 and loaded by thousands of sites; Dark Reading describes a weeklong compromise that pushed fingerprinting code to potentially thousands of iPhone and Android users. Fingerprinting led to exploit chains and, on selected devices, collection of personal data. Dark Reading says targets included government, diplomatic, technology and healthcare organizations, focused on Ukraine and the United States.

Key facts
  • Sekoia attributes the mid-October 2026 campaign to APT29, linked to Russia's SVR.
  • Plerdy, a Ukrainian SEO and analytics service, was used to deliver fingerprinting code.
  • Security Affairs says targets included iOS 16.7 and Android Chrome.
  • Payloads exfiltrated device data before selective exploitation, according to Security Affairs.
  • Dark Reading also names the group Cozy Bear, Midnight Blizzard and The Dukes.
Analyze this story with Vani AIImpact, who is affected and what defenders should do, in a new chat

What each outlet adds

beyond the shared facts
  • Security AffairsAugust–September Plerdy window, country list, iOS 16.7 and Chrome targets.
  • Dark ReadingWeeklong compromise, SVR aliases, and named sector targets.
Threat actors
APT29
Victims
US chemical industry associationEuropean far-right political partyBulgarian military websiteUkrainian gas production companyPlerdy analytics serviceUkraine SEO and website analytics service
Countries
RussiaUkraineUSCzech RepublicBulgariaUnited States

Coverage

oldest first · one row per article · UTC
  1. · 6d ago Security AffairsFirst report

    APT29 uses watering hole attacks on mobile devices

    Sekoia linked APT29 to a mid-October 2026 campaign targeting iOS and Android via hacked sites and compromised analytics service.

  2. · 6d ago Dark Reading

    APT29 uses watering holes to target mobile users

    Russian state-sponsored APT29 compromised a Ukrainian SEO site to distribute fingerprinting code to potentially thousands of iPhone and Android users.