[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$ftgwQeBtCaZmJXwHSNCsxbONMH0i79nHd17LmqpcCDfs":3},{"article":4,"iocs":52,"watch_terms":55,"solutions":56,"lesson":145},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":31,"category":32,"article_tags":36},"089c2168-e736-4837-90b2-765b16aeb2b2","APT29-Linked Hackers Hijack Web Analytics Script to Deliver iOS and Android Exploits","apt29-linked-hackers-hijack-web-analytics-script-to-deliver-ios-and-android-expl-f4b7ff","The Russia-linked threat actor known as APT29 is said to be behind a large-scale watering hole campaign targeting iOS and Android users through compromised websites, fake domains, and a supply chain attack involving a Ukrainian web analytics service called Plerdy SEO Tracker. \"The injected JavaScript code collects browser and device attributes,\" Sekoia researchers Amaury-Jacques Garçon and","Russia-linked APT29 conducted a large-scale watering hole campaign targeting iOS and Android users by compromising websites and injecting malicious JavaScript into Plerdy SEO Tracker, a Ukrainian web analytics service. The injected code collects browser and device attributes to facilitate exploitation. This supply chain attack demonstrates APT29's sophisticated tactics in leveraging third-party services for widespread mobile device compromise.","APT29 hijacks Ukrainian web analytics script to deliver iOS and Android exploits via watering hole attacks.","https:\u002F\u002Fthehackernews.com\u002F2026\u002F11\u002Fapt29-linked-hackers-hijack-web.html","https:\u002F\u002Fblogger.googleusercontent.com\u002Fimg\u002Fb\u002FR29vZ2xl\u002FAVvXsEhx1cus2o8fkYGLhQu9BfPgGtAUwnmTAMucLagfAodBuRoYnyxGIJKgpqtKFyCSV-WSG3pDqmPujhj-iwoOZB-zF8JjbQMrLzDHYtdTPA3hD3Kc3rqYQM4CQwkICwZkh8K6O8ZSt-WAA_PBoUA6lHwh_55dbDlKizsjzcTN847c9BSHsWHmrAP42JHRHIYS\u002Fs1600\u002Fios-exploit.jpg","2026-11-04T14:27:52+00:00","2026-11-04T15:00:34.707915+00:00",9,[17,20,23,26,29],{"name":18,"type":19},"APT29","threat_actor",{"name":21,"type":22},"Plerdy SEO Tracker","product",{"name":24,"type":25},"Sekoia","vendor",{"name":27,"type":28},"iOS","technology",{"name":30,"type":28},"Android","6cbdd207-aaa1-4176-9534-e156b125e917",{"id":31,"icon":33,"name":34,"slug":35},null,"Nation-state","nation-state",[37,42,47],{"category":38},{"id":39,"icon":33,"name":40,"slug":41},"26b0b636-0e31-4db1-bffb-61bdf9f20a58","Supply Chain","supply-chain",{"category":43},{"id":44,"icon":33,"name":45,"slug":46},"89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5","Malware","malware",{"category":48},{"id":49,"icon":33,"name":50,"slug":51},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[53],{"type":46,"value":18,"context":54},"Russia-linked nation-state threat actor conducting watering hole campaign",[24,21],{"controls":57,"vendors":144},[58,86,115],{"slug":51,"name":59,"problem":60,"products":61},"Threat intelligence","Attack campaigns reach your sector, suppliers or software before your team hears about them.",[62,70,78],{"vendor_slug":63,"vendor_name":64,"vendor_logo":65,"product_slug":66,"product_name":67,"url":68,"description":69},"google","Google","\u002Fvendor-logos\u002Fgoogle.png","google-threat-intelligence","Google Threat Intelligence","https:\u002F\u002Fcloud.google.com\u002Fsecurity\u002Fproducts\u002Fthreat-intelligence","Threat intelligence from Mandiant's frontline investigations, Google's threat analysts, open sources and Google's own visibility, in one service.",{"vendor_slug":71,"vendor_name":72,"vendor_logo":73,"product_slug":74,"product_name":75,"url":76,"description":77},"dataminr","Dataminr","\u002Fvendor-logos\u002Fdataminr.png","agentic-threat-intelligence-platform","Agentic Threat Intelligence Platform","https:\u002F\u002Fwww.dataminr.com\u002Fproducts\u002Fcyber-defense\u002Fagentic-threat-intelligence-platform\u002F","Threat intelligence platform, formerly ThreatConnect TI Ops, that collects, scores and structures intelligence and pushes it into security tools.",{"vendor_slug":79,"vendor_name":80,"vendor_logo":81,"product_slug":82,"product_name":83,"url":84,"description":85},"reliaquest","ReliaQuest","\u002Fvendor-logos\u002Freliaquest.png","greymatter-digital-risk-protection","GreyMatter Digital Risk Protection","https:\u002F\u002Freliaquest.com\u002Fsecurity-operations-platform\u002Fdark-web-and-digital-risk-protection\u002F","Watches the open, deep and dark web for threats aimed at an organisation and alerts its security team in real time.",{"slug":87,"name":88,"problem":89,"products":90},"third-party-risk-management","Third-party risk management (TPRM)","You know which suppliers could hurt you, and you hear quickly when one of them is breached.",[91,99,107],{"vendor_slug":92,"vendor_name":93,"vendor_logo":94,"product_slug":95,"product_name":96,"url":97,"description":98},"securityscorecard","SecurityScorecard","\u002Fvendor-logos\u002Fsecurityscorecard.png","security-ratings","SecurityScorecard Ratings","https:\u002F\u002Fsecurityscorecard.com\u002Fsolutions\u002Fuse-cases\u002Fsecurity-ratings\u002F","Outside-in security ratings and monitoring of suppliers.",{"vendor_slug":100,"vendor_name":101,"vendor_logo":102,"product_slug":103,"product_name":104,"url":105,"description":106},"bitsight","Bitsight","\u002Fvendor-logos\u002Fbitsight.png","bitsight-tprm","Bitsight Third-Party Risk Management","https:\u002F\u002Fwww.bitsight.com\u002Fproducts\u002Fthird-party-risk-management","Supplier assessments and continuous monitoring based on security ratings.",{"vendor_slug":108,"vendor_name":109,"vendor_logo":110,"product_slug":111,"product_name":112,"url":113,"description":114},"upguard","UpGuard","\u002Fvendor-logos\u002Fupguard.png","upguard-vendor-risk","UpGuard Vendor Risk","https:\u002F\u002Fwww.upguard.com\u002Fproduct\u002Fvendor-risk","Supplier security questionnaires, ratings and continuous monitoring.",{"slug":116,"name":117,"problem":118,"products":119},"software-supply-chain","Software supply chain security","Malicious and vulnerable open-source packages are caught before they ship.",[120,128,136],{"vendor_slug":121,"vendor_name":122,"vendor_logo":123,"product_slug":124,"product_name":125,"url":126,"description":127},"jfrog","JFrog","\u002Fvendor-logos\u002Fjfrog.png","jfrog-curation","JFrog Curation","https:\u002F\u002Fjfrog.com\u002Fcuration\u002F","Blocks malicious and risky open-source packages before they enter your repositories.",{"vendor_slug":129,"vendor_name":130,"vendor_logo":131,"product_slug":132,"product_name":133,"url":134,"description":135},"github","GitHub","\u002Fvendor-logos\u002Fgithub.png","advanced-security","GitHub Advanced Security","https:\u002F\u002Fgithub.com\u002Fsecurity\u002Fadvanced-security","Dependency review, code scanning and secret scanning with push protection.",{"vendor_slug":137,"vendor_name":138,"vendor_logo":139,"product_slug":140,"product_name":141,"url":142,"description":143},"sonatype","Sonatype","\u002Fvendor-logos\u002Fsonatype.png","sonatype-firewall","Sonatype Firewall","https:\u002F\u002Fwww.sonatype.com\u002Fproducts\u002Fsonatype-firewall","Blocks malicious and policy-violating open-source components at download.",[],{"slug":146,"title":147,"body":148,"framework_refs":149,"framework_notes":157},"apt29-poisons-web-analytics-script-in-watering-hole-attack-on-mobile-users","APT29 Poisons Web Analytics Script in Watering Hole Attack on Mobile Users","APT29 compromised the Plerdy SEO Tracker, a third-party web analytics service, injecting malicious JavaScript that fingerprints and exploits iOS and Android visitors across any site using the script. This is a classic supply chain attack: by targeting one widely-used third-party component, attackers gained a multiplier effect, reaching potentially thousands of end users through trusted websites. The root cause is insufficient vetting, integrity verification, and monitoring of third-party scripts embedded in web properties. This matters because organisations often treat third-party analytics as low-risk, failing to apply the same security scrutiny they would to first-party code, creating a blind spot that sophisticated threat actors deliberately exploit.",[150,151,152,153,154,155,156],"CIS Control 7: Continuous Vulnerability Management","OWASP A06:2021 Vulnerable and Outdated Components","NIST SP 800-53 SI-2: Flaw Remediation","ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities","MITRE ATT&CK T1566: Phishing","NIS2 Article 21(2)(b)","CIS Control 17: Incident Response Management",{"NIS2 Article 21(2)(b)":158,"MITRE ATT&CK T1566: Phishing":159,"NIST SP 800-53 SI-2: Flaw Remediation":160,"CIS Control 17: Incident Response Management":161,"OWASP A06:2021 Vulnerable and Outdated Components":162,"CIS Control 7: Continuous Vulnerability Management":163,"ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities":164},"NIS2 explicitly requires supply chain security measures including policies on the security of relationships with direct suppliers and service providers, directly addressing the third-party analytics script compromise vector used here.","While not email phishing, APT29 used a watering hole variant of the same delivery principle — luring victims to a compromised trusted resource — which ATT&CK categorises under web-based delivery sub-techniques relevant to this campaign.","SI-2 requires organisations to identify, report, and remediate flaws in information system components, which extends to monitoring third-party scripts for unauthorised modifications.","A tested incident response plan covering supply chain compromise scenarios would have accelerated detection and removal of the malicious script, reducing the window of exposure across affected websites.","This attack exploited trust in an unverified third-party component; OWASP A06 directly mandates integrity verification and ongoing monitoring of all externally sourced code.","Regular scanning of web properties and third-party script inventories would have identified the tampered Plerdy script before it could deliver exploits to site visitors.","A.8.8 requires timely identification and management of technical vulnerabilities in all assets, including third-party web components that could be weaponised against an organisation's users."]