[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f_qrzrHzoaHsJmAEc_Bmq8Lhhd80nLXcAZ_5_5aMKvVQ":3},{"article":4,"iocs":55,"watch_terms":84,"solutions":85,"lesson":184},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":32,"category":33,"article_tags":37},"22f5775a-d77e-414f-bf33-383850061528","Russian APT29 Hackers Turn Trusted Websites Into Traps to Compromise iPhone and Android Users","russian-apt29-hackers-turn-trusted-websites-into-traps-to-compromise-iphone-and-686353","A Russian state-linked hacking group is using trusted websites to quietly break into phones. Researchers say APT29, also known as Midnight Blizzard or Cozy Bear, planted hidden code on real and cloned sites in the US, Ukraine, the Czech Republic and Bulgaria. Visitors with out-of-date iPhones or Android phones can lose cookies, Wi-Fi passwords and, […] The post Russian APT29 Hackers Turn Trusted Websites Into Traps to Compromise iPhone and Android Users appeared first on Cyber Security News.","Russian state-linked APT29 (Midnight Blizzard\u002FCozy Bear) is conducting a watering hole campaign, compromising legitimate and lookalike websites to deliver exploits. The campaign, active since mid-October 2026, uses hidden JavaScript to check visitor devices and deploy exploits targeting unpatched vulnerabilities on older iOS and Android versions, potentially stealing sensitive data.","APT29 uses trusted websites to deliver exploits targeting outdated iPhones and Android phones.","https:\u002F\u002Fcybersecuritynews.com\u002Frussian-apt29-hackers\u002F","https:\u002F\u002Fcybersecuritynews.com\u002Fwp-content\u002Fuploads\u002F2026\u002F11\u002FRussian-APT29-Hackers-Turn-Trusted-Websites-Into-Traps-to-Compromise-iPhone-and-Android-Users.webp","2026-11-04T11:23:49+00:00","2026-11-04T12:00:30.143057+00:00",9,[17,20,22,24,27,29],{"name":18,"type":19},"APT29","threat_actor",{"name":21,"type":19},"Midnight Blizzard",{"name":23,"type":19},"Cozy Bear",{"name":25,"type":26},"iPhone","product",{"name":28,"type":26},"Android",{"name":30,"type":31},"JavaScript","technology","6cbdd207-aaa1-4176-9534-e156b125e917",{"id":32,"icon":34,"name":35,"slug":36},null,"Nation-state","nation-state",[38,40,45,50],{"category":39},{"id":32,"icon":34,"name":35,"slug":36},{"category":41},{"id":42,"icon":34,"name":43,"slug":44},"80544778-fabb-4dcd-aa35-17492e5dcf4f","Vulnerabilities","vulnerabilities",{"category":46},{"id":47,"icon":34,"name":48,"slug":49},"89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5","Malware","malware",{"category":51},{"id":52,"icon":34,"name":53,"slug":54},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[56,60,62,66,69,72,74,76,78,81],{"type":57,"value":58,"context":59},"domain","america250[.]holiday","Lookalike domain used in watering hole campaign",{"type":57,"value":61,"context":59},"theowo[.]club",{"type":63,"value":64,"context":65},"cve","CVE-2025-43529","Exploit chain A and B targeting iOS",{"type":63,"value":67,"context":68},"CVE-2024-27834","Exploit chain A targeting iOS",{"type":63,"value":70,"context":71},"CVE-2026-20700","Exploit chain B targeting iOS",{"type":63,"value":73,"context":71},"CVE-2025-14174",{"type":63,"value":75,"context":71},"CVE-2025-43510",{"type":63,"value":77,"context":71},"CVE-2025-43520",{"type":63,"value":79,"context":80},"CVE-2026-3910","Exploit chain C targeting Android",{"type":63,"value":82,"context":83},"CVE-2025-27038","Exploit chain C targeting Android (Adreno graphics driver flaw)",[25,28],{"controls":86,"vendors":172},[87,115,144],{"slug":88,"name":89,"problem":90,"products":91},"patch-management","Automated patch management","Known holes get closed in days, not months.",[92,100,107],{"vendor_slug":93,"vendor_name":94,"vendor_logo":95,"product_slug":96,"product_name":97,"url":98,"description":99},"ninjaone","NinjaOne","\u002Fvendor-logos\u002Fninjaone.png","ninjaone-patch-management","NinjaOne Patch Management","https:\u002F\u002Fwww.ninjaone.com\u002Fpatch-management\u002F","Automated patching of operating systems and third-party applications from the cloud.",{"vendor_slug":101,"vendor_name":102,"vendor_logo":103,"product_slug":88,"product_name":104,"url":105,"description":106},"qualys","Qualys","\u002Fvendor-logos\u002Fqualys.png","Qualys Patch Management","https:\u002F\u002Fwww.qualys.com\u002Fapps\u002Fpatch-management\u002F","Patch deployment for operating systems and third-party applications, linked to vulnerability findings.",{"vendor_slug":108,"vendor_name":109,"vendor_logo":110,"product_slug":111,"product_name":112,"url":113,"description":114},"action1","Action1","\u002Fvendor-logos\u002Faction1.png","action1-patch-management","Action1 Patch Management","https:\u002F\u002Fwww.action1.com\u002F","Cloud-native patch management for Windows, macOS and third-party applications.",{"slug":116,"name":117,"problem":118,"products":119},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[120,128,136],{"vendor_slug":121,"vendor_name":122,"vendor_logo":123,"product_slug":124,"product_name":125,"url":126,"description":127},"huntress","Huntress","\u002Fvendor-logos\u002Fhuntress.png","managed-edr","Huntress Managed EDR","https:\u002F\u002Fwww.huntress.com\u002Fplatform\u002Fmanaged-edr","Endpoint detection and response monitored around the clock by Huntress analysts.",{"vendor_slug":129,"vendor_name":130,"vendor_logo":131,"product_slug":132,"product_name":133,"url":134,"description":135},"palo-alto-networks","Palo Alto Networks","\u002Fvendor-logos\u002Fpalo-alto-networks.png","cortex-xdr","Cortex XDR","https:\u002F\u002Fwww.paloaltonetworks.com\u002Fcortex\u002Fcortex-xdr","Endpoint detection and response with extended detection across network, cloud and identity.",{"vendor_slug":137,"vendor_name":138,"vendor_logo":139,"product_slug":140,"product_name":141,"url":142,"description":143},"sentinelone","SentinelOne","\u002Fvendor-logos\u002Fsentinelone.png","singularity-endpoint","Singularity Endpoint","https:\u002F\u002Fwww.sentinelone.com\u002Fplatform\u002Fendpoint-security\u002F","Endpoint protection and detection with automated response and rollback.",{"slug":54,"name":145,"problem":146,"products":147},"Threat intelligence","Attack campaigns reach your sector, suppliers or software before your team hears about them.",[148,156,164],{"vendor_slug":149,"vendor_name":150,"vendor_logo":151,"product_slug":152,"product_name":153,"url":154,"description":155},"crowdstrike","CrowdStrike","\u002Fvendor-logos\u002Fcrowdstrike.png","falcon-adversary-intelligence","Falcon Adversary Intelligence","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fplatform\u002Fthreat-intelligence\u002F","Threat intelligence on the adversaries CrowdStrike tracks, built into the Falcon platform to detect, disrupt and defend against them.",{"vendor_slug":157,"vendor_name":158,"vendor_logo":159,"product_slug":160,"product_name":161,"url":162,"description":163},"recorded-future","Recorded Future","\u002Fvendor-logos\u002Frecorded-future.png","recorded-future-cyber-operations","Recorded Future Cyber Operations","https:\u002F\u002Fwww.recordedfuture.com\u002Fproducts\u002Fcyber-operations","Threat intelligence built into security operations workflows, to prioritise alerts and act on threats before they arrive.",{"vendor_slug":165,"vendor_name":166,"vendor_logo":167,"product_slug":168,"product_name":169,"url":170,"description":171},"dataminr","Dataminr","\u002Fvendor-logos\u002Fdataminr.png","dataminr-threat-intelligence","Dataminr Threat Intelligence","https:\u002F\u002Fwww.dataminr.com\u002Fproducts\u002Fcyber-defense\u002Fthreat-intelligence\u002F","Real-time alerts on emerging cyber threats, exploited vulnerabilities and attacks relevant to your organisation, detected with AI across a large set of public data sources.",[173,179],{"slug":174,"name":175,"logo_path":176,"roles":177},"apple","Apple","\u002Fvendor-logos\u002Fapple.png",[178],"affected",{"slug":180,"name":181,"logo_path":182,"roles":183},"google","Google","\u002Fvendor-logos\u002Fgoogle.png",[178],{"slug":185,"title":186,"body":187,"framework_refs":188,"framework_notes":196},"apt29-exploits-unpatched-mobile-os-vulnerabilities-via-watering-hole-campaign","APT29 Exploits Unpatched Mobile OS Vulnerabilities via Watering Hole Campaign","Russian state-sponsored APT29 compromised legitimate and lookalike websites to silently fingerprint visiting devices and serve targeted exploits against unpatched vulnerabilities in older iOS and Android versions — a classic watering hole attack. The root cause is a failure in patch management: users and organizations running outdated mobile operating systems remained exposed to known vulnerabilities that had available fixes. This matters because even cautious users who avoid suspicious links can be compromised simply by visiting a trusted website, making unpatched devices an organization-wide liability. The theft of sensitive data from executive or privileged-user devices can cascade into broader enterprise compromise, espionage, or credential harvesting.",[189,190,191,192,193,194,195],"CIS Control 7: Continuous Vulnerability Management","NIST SP 800-53 SI-2: Flaw Remediation","ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities","OWASP A06:2021 Vulnerable and Outdated Components","MITRE ATT&CK T1566: Phishing","NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control","NIS2 Article 21(2)(b)",{"NIS2 Article 21(2)(b)":197,"MITRE ATT&CK T1566: Phishing":198,"NIST SP 800-53 SI-2: Flaw Remediation":199,"OWASP A06:2021 Vulnerable and Outdated Components":200,"CIS Control 7: Continuous Vulnerability Management":201,"ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities":202,"NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control":203},"NIS2 requires entities to implement policies on incident handling and risk management including patch and vulnerability management; compliance would have obligated organizations to maintain mobile OS currency and reduce exposure to this state-sponsored campaign.","While not email-based, APT29's use of lookalike and compromised legitimate websites to lure victims maps to drive-by compromise tactics closely related to T1566's theme of delivering exploits through trusted-looking delivery channels.","SI-2 requires organizations to identify, report, and correct system flaws within defined timeframes; adherence would have mandated patching the unpatched mobile OS vulnerabilities before APT29 could exploit them.","The campaign specifically targeted devices running outdated iOS and Android versions with known unpatched flaws — a textbook instance of the risk OWASP A06 warns against when components are not kept current.","Regularly scanning mobile endpoints and enforcing timely patching of known iOS and Android vulnerabilities would have removed the attack surface APT29 relied upon to deliver its exploits.","This control requires timely identification and remediation of technical vulnerabilities in organizational assets, including mobile devices, which would have directly prevented exploitation of the outdated OS versions targeted in this campaign.","Enforcing MDM-based conditional access that denies network resources to devices below the minimum patch level would have reduced the exposed population by blocking unpatched devices before they could become a data-theft vector."]