Russian APT29 Targets Mobile Users with Watering Hole Attacks

APT29 exploited the implicit trust users place in legitimate websites by compromising them directly and infiltrating a widely-used third-party analytics service (Plerdy), effectively turning trusted infrastructure into a malware distribution network. This multi-vector watering hole campaign demonstrates how supply chain compromise can silently extend a threat actor's reach to thousands of downstream sites without those site owners taking any direct action. The targeting of mobile users is particularly significant, as mobile devices often have fewer endpoint controls and users are less likely to scrutinize URLs or certificate details on small screens. Organizations that embedded Plerdy's analytics script inherited the risk without knowledge, illustrating that third-party dependencies are an often-overlooked attack surface. This matters because even security-conscious users visiting legitimate, known-good websites could be silently compromised.