[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fB91ps1ZkBBnTQs1mffhoVHZq3D6l8_kMW0AxIuOSuW4":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"framework_notes":19,"status":27,"created_at":28,"published_at":29,"article":30,"tags":34,"podcasts":47,"controls":48},"db1bd10c-ee1d-4637-8b71-c6547c81e082","apt29-exploits-unpatched-ios-and-android-devices-via-compromised-websites","e35c3306-fbc5-4e71-b6bb-6aef5edf16cf","APT29 Exploits Unpatched iOS and Android Devices via Compromised Websites","Russian state-sponsored group APT29 leveraged n-day exploits — vulnerabilities that have already been patched but remain unaddressed on victim devices — to compromise iOS and Android users across multiple industries. The campaign succeeded precisely because organizations and individuals failed to apply available security patches in a timely manner, leaving known attack surfaces open. By hijacking analytics services and using lookalike domains, the attackers amplified their reach without needing zero-day capabilities. This incident underscores that patch lag, not just zero-days, represents one of the most exploited weaknesses in modern threat campaigns and can have severe consequences including theft of credentials, messages, and sensitive network data.","**Immediate actions:**\n- Enforce mandatory mobile device patching policies requiring iOS and Android updates within 72 hours of a security release across all organization-managed devices.\n- Audit and block access to third-party analytics services and external JavaScript dependencies that have not been explicitly vetted by your security team.\n- Deploy Mobile Device Management (MDM) solutions to enforce minimum OS version compliance and remotely remediate non-compliant devices.\n\n**Long-term improvements:**\n- Establish a formal vulnerability management program with defined SLAs for patching critical vulnerabilities on mobile endpoints, servers, and third-party services.\n- Implement domain monitoring and lookalike domain detection services to identify impersonation infrastructure targeting your organization before it reaches end users.\n- Conduct regular third-party supply chain reviews of analytics, advertising, and CDN providers embedded in your web properties to reduce watering-hole attack exposure.\n\n**Detection measures:**\n- Deploy endpoint detection and response (EDR) tools on managed mobile devices capable of identifying exploitation attempts and anomalous cookie or credential exfiltration activity.\n- Enable DNS-layer filtering and web proxy logging to detect and alert on connections to known malicious or newly registered lookalike domains.\n- Monitor authentication logs for stolen-cookie-based session hijacking by flagging sessions with anomalous geolocations or device fingerprint mismatches.",[12,13,14,15,16,17,18],"CIS Control 7: Continuous Vulnerability Management","NIST SP 800-53 SI-2: Flaw Remediation","ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities","OWASP A06:2021 Vulnerable and Outdated Components","MITRE ATT&CK T1566: Phishing","NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control","NIS2 Article 21(2)(b)",{"NIS2 Article 21(2)(b)":20,"MITRE ATT&CK T1566: Phishing":21,"NIST SP 800-53 SI-2: Flaw Remediation":22,"OWASP A06:2021 Vulnerable and Outdated Components":23,"CIS Control 7: Continuous Vulnerability Management":24,"ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities":25,"NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control":26},"NIS2 requires essential and important entities to implement incident handling and vulnerability management practices — the targeted gas producers and other critical sector organizations would be obligated to have patching controls that this attack circumvented.","APT29 used compromised websites and lookalike domains as infection vectors, mirroring the watering-hole and spearphishing delivery techniques catalogued under T1566, highlighting the need for user awareness and web filtering controls.","SI-2 requires organizations to identify, report, and correct information system flaws — timely application of the available iOS and Android patches would have directly prevented exploitation.","The attack relied on known, unpatched components in mobile operating systems — a textbook instance of the risk OWASP A06 addresses by requiring organizations to track and update vulnerable software components.","APT29 exploited patched but unapplied vulnerabilities; a continuous vulnerability management program with enforced patching SLAs would have eliminated the attack surface before the campaign began.","This control mandates timely identification and remediation of technical vulnerabilities; had organizations tracked and acted on the published CVEs, n-day exploitation would not have been possible.","The campaign specifically targeted session cookies to bypass authentication; strong session management controls and anomaly detection on authenticated sessions would have limited the value of stolen credentials.","published","2026-11-04T15:20:46.480648+00:00","2026-11-04T15:20:46.465+00:00",{"id":7,"url":31,"slug":32,"title":33},"https:\u002F\u002Fwww.helpnetsecurity.com\u002F2026\u002F11\u002F04\u002Fapt29-watering-hole-mobile-devices-n-day-exploits\u002F","russian-hackers-target-ios-and-android-users-with-n-day-exploits-c630f4","Russian hackers target iOS and Android users with n-day exploits",[35,41],{"id":36,"name":37,"slug":38,"description":39,"color":40},"05757c8d-6b93-4194-b35d-7359e7d33b0e","Vulnerability Management","vulnerability-management","Missing scans, no risk prioritization","#fb923c",{"id":42,"name":43,"slug":44,"description":45,"color":46},"af7fce9e-1ce8-4156-93bc-09dcfbfdf29d","Patch Management","patch-management","Unpatched vulnerabilities, delayed updates","#ef4444",[],[49,53,57],{"slug":50,"name":51,"problem":52},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",{"slug":54,"name":55,"problem":56},"threat-intelligence","Threat intelligence","Attack campaigns reach your sector, suppliers or software before your team hears about them.",{"slug":58,"name":59,"problem":60},"dns-web-filtering","DNS filtering and secure web gateway","Users cannot reach known-malicious sites, and malware cannot phone home."]