[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$feT6arOQpmNhN_S2UBGDV6VwxMpnubsV36RTYJS5KtBw":3},{"article":4,"iocs":52,"watch_terms":63,"solutions":64,"lesson":153},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":31,"category":32,"article_tags":36},"30d69caa-ee6d-466c-86ec-904539d87246","Russian APT29 Targets Mobile Users with Watering Hole Attacks","russian-apt29-targets-mobile-users-with-watering-hole-attacks-291326","Russia-linked group APT29 targeted iOS and Android users through hijacked websites and a compromised analytics service. Sekoia says a large-scale watering hole campaign is going after iOS and Android users, and it links the campaign to APT29 (aka SVR group, Cozy Bear, Nobelium, BlueBravo, Midnight Blizzard, and The Dukes), the Russian group tied to the SVR foreign intelligence service. A watering hole […]","Russia-linked APT29 conducted a multi-vector watering hole campaign discovered in October 2026, targeting mobile users across the US, Ukraine, Czech Republic, and Bulgaria. The group compromised legitimate websites, created fake clones, and infiltrated the Ukrainian Plerdy analytics service to distribute malicious payloads to thousands of websites. Notable targets included a US chemical industry association, a fake luxury hotel website near UK government institutions (potentially targeting diplomatic delegations), and Ukrainian military-related sites.","APT29 launches large-scale watering hole campaign targeting iOS and Android users via hijacked websites and compromised","https:\u002F\u002Fsecurityaffairs.com\u002F202473\u002Fapt\u002Frussian-apt29-targets-mobile-users-with-watering-hole-attacks.html","https:\u002F\u002Fsecurityaffairs.com\u002Fwp-content\u002Fuploads\u002F2026\u002F11\u002Fimage-7.png","2026-11-05T10:00:52+00:00","2026-11-05T11:00:35.245068+00:00",9,[17,20,22,25,28],{"name":18,"type":19},"APT29","threat_actor",{"name":21,"type":19},"SVR (Russian Foreign Intelligence Service)",{"name":23,"type":24},"Plerdy","product",{"name":26,"type":27},"Sekoia","vendor",{"name":29,"type":30},"APT29 Watering Hole Campaign (October 2026)","campaign","6cbdd207-aaa1-4176-9534-e156b125e917",{"id":31,"icon":33,"name":34,"slug":35},null,"Nation-state","nation-state",[37,42,47],{"category":38},{"id":39,"icon":33,"name":40,"slug":41},"26b0b636-0e31-4db1-bffb-61bdf9f20a58","Supply Chain","supply-chain",{"category":43},{"id":44,"icon":33,"name":45,"slug":46},"89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5","Malware","malware",{"category":48},{"id":49,"icon":33,"name":50,"slug":51},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[53,57,60],{"type":54,"value":55,"context":56},"domain","a.plerdy.com","Compromised Ukrainian analytics service used to inject malicious scripts (Aug 27 - Sep 3, 2026)",{"type":54,"value":58,"context":59},"theowo.club","Fake reverse proxy website impersonating Raffles London at The OWO luxury hotel, used for potential spear-phishing of diplomatic delegations",{"type":46,"value":61,"context":62},"APT29 profiling script","Malicious JavaScript injected into compromised websites and analytics service for reconnaissance and potential device exploitation",[26,23],{"controls":65,"vendors":152},[66,95,123],{"slug":67,"name":68,"problem":69,"products":70},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[71,79,87],{"vendor_slug":72,"vendor_name":73,"vendor_logo":74,"product_slug":75,"product_name":76,"url":77,"description":78},"huntress","Huntress","\u002Fvendor-logos\u002Fhuntress.png","managed-edr","Huntress Managed EDR","https:\u002F\u002Fwww.huntress.com\u002Fplatform\u002Fmanaged-edr","Endpoint detection and response monitored around the clock by Huntress analysts.",{"vendor_slug":80,"vendor_name":81,"vendor_logo":82,"product_slug":83,"product_name":84,"url":85,"description":86},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","defender-for-endpoint","Microsoft Defender for Endpoint","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fendpoint-security\u002Fmicrosoft-defender-endpoint","Endpoint detection and response for Windows, macOS, Linux and mobile devices.",{"vendor_slug":88,"vendor_name":89,"vendor_logo":90,"product_slug":91,"product_name":92,"url":93,"description":94},"elastic","Elastic","\u002Fvendor-logos\u002Felastic.png","elastic-security","Elastic Security","https:\u002F\u002Fwww.elastic.co\u002Fsecurity","SIEM and endpoint security built on Elasticsearch, with open detection rules.",{"slug":51,"name":96,"problem":97,"products":98},"Threat intelligence","Attack campaigns reach your sector, suppliers or software before your team hears about them.",[99,107,115],{"vendor_slug":100,"vendor_name":101,"vendor_logo":102,"product_slug":103,"product_name":104,"url":105,"description":106},"google","Google","\u002Fvendor-logos\u002Fgoogle.png","google-threat-intelligence","Google Threat Intelligence","https:\u002F\u002Fcloud.google.com\u002Fsecurity\u002Fproducts\u002Fthreat-intelligence","Threat intelligence from Mandiant's frontline investigations, Google's threat analysts, open sources and Google's own visibility, in one service.",{"vendor_slug":108,"vendor_name":109,"vendor_logo":110,"product_slug":111,"product_name":112,"url":113,"description":114},"recorded-future","Recorded Future","\u002Fvendor-logos\u002Frecorded-future.png","recorded-future-cyber-operations","Recorded Future Cyber Operations","https:\u002F\u002Fwww.recordedfuture.com\u002Fproducts\u002Fcyber-operations","Threat intelligence built into security operations workflows, to prioritise alerts and act on threats before they arrive.",{"vendor_slug":116,"vendor_name":117,"vendor_logo":118,"product_slug":119,"product_name":120,"url":121,"description":122},"reliaquest","ReliaQuest","\u002Fvendor-logos\u002Freliaquest.png","greymatter-digital-risk-protection","GreyMatter Digital Risk Protection","https:\u002F\u002Freliaquest.com\u002Fsecurity-operations-platform\u002Fdark-web-and-digital-risk-protection\u002F","Watches the open, deep and dark web for threats aimed at an organisation and alerts its security team in real time.",{"slug":124,"name":125,"problem":126,"products":127},"dns-web-filtering","DNS filtering and secure web gateway","Users cannot reach known-malicious sites, and malware cannot phone home.",[128,136,144],{"vendor_slug":129,"vendor_name":130,"vendor_logo":131,"product_slug":132,"product_name":133,"url":134,"description":135},"cisco","Cisco","\u002Fvendor-logos\u002Fcisco.png","umbrella","Cisco Umbrella","https:\u002F\u002Fumbrella.cisco.com\u002F","DNS-layer security and secure web gateway delivered from the cloud.",{"vendor_slug":137,"vendor_name":138,"vendor_logo":139,"product_slug":140,"product_name":141,"url":142,"description":143},"netskope","Netskope","\u002Fvendor-logos\u002Fnetskope.png","netskope-swg","Netskope Secure Web Gateway","https:\u002F\u002Fwww.netskope.com\u002Fproducts\u002Fnext-gen-swg","Cloud secure web gateway with inspection of web and cloud app traffic.",{"vendor_slug":145,"vendor_name":146,"vendor_logo":147,"product_slug":148,"product_name":149,"url":150,"description":151},"quad9","Quad9","\u002Fvendor-logos\u002Fquad9.png","quad9-dns","Quad9 DNS","https:\u002F\u002Fwww.quad9.net\u002F","Free, privacy-focused DNS resolver that blocks malicious domains using threat intelligence feeds.",[],{"slug":154,"title":155,"body":156,"framework_refs":157,"framework_notes":165},"apt29-weaponizes-trusted-websites-and-analytics-services-to-target-mobile-users","APT29 Weaponizes Trusted Websites and Analytics Services to Target Mobile Users","APT29 exploited the implicit trust users place in legitimate websites by compromising them directly and infiltrating a widely-used third-party analytics service (Plerdy), effectively turning trusted infrastructure into a malware distribution network. This multi-vector watering hole campaign demonstrates how supply chain compromise can silently extend a threat actor's reach to thousands of downstream sites without those site owners taking any direct action. The targeting of mobile users is particularly significant, as mobile devices often have fewer endpoint controls and users are less likely to scrutinize URLs or certificate details on small screens. Organizations that embedded Plerdy's analytics script inherited the risk without knowledge, illustrating that third-party dependencies are an often-overlooked attack surface. This matters because even security-conscious users visiting legitimate, known-good websites could be silently compromised.",[158,159,160,161,162,163,164],"CIS Control 15: Service Provider Management","NIST SP 800-53 SI-2: Flaw Remediation","MITRE ATT&CK T1566: Phishing","ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities","NIS2 Article 21(2)(b)","CIS Control 14: Security Awareness and Skills Training","NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control",{"NIS2 Article 21(2)(b)":166,"MITRE ATT&CK T1566: Phishing":167,"NIST SP 800-53 SI-2: Flaw Remediation":168,"CIS Control 15: Service Provider Management":169,"CIS Control 14: Security Awareness and Skills Training":170,"ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities":171,"NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control":172},"NIS2 explicitly requires covered entities to address supply chain security risks; the compromise of Plerdy to inject malicious payloads into thousands of dependent websites is precisely the upstream supply chain incident NIS2 Article 21(2)(b) mandates organizations to guard against.","The creation of fake cloned websites (e.g., a luxury hotel near UK government buildings) mirrors spearphishing site techniques designed to harvest credentials or deliver payloads to targeted individuals such as diplomatic delegations.","Compromised websites and the analytics supply chain likely involved unpatched or misconfigured components; SI-2 mandates timely identification and remediation of flaws in both internal systems and third-party software dependencies.","APT29 compromised the Plerdy third-party analytics service to reach thousands of downstream websites; CIS Control 15 requires organizations to inventory and assess the security of all external service providers supplying code or services that touch their environment.","Mobile users were specifically targeted because they are less likely to detect suspicious redirects or script injections; training users to recognize watering hole indicators and apply skepticism on mobile browsers would reduce the effectiveness of this campaign.","Infiltration of the Plerdy analytics service represents a technical vulnerability in the software supply chain; A.8.8 requires organizations to evaluate and manage vulnerabilities in all technology, including third-party components integrated into their services.","Attackers compromised legitimate website credentials to inject malicious content; enforcing strong authentication and least-privilege access controls for website administrators and analytics platform accounts would have limited the attacker's ability to modify site content."]