[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$ffvYkXrDfQnRrj6WaiWxoXnzgIbcnoxNtYxRuRdCUjrY":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"framework_notes":19,"status":27,"created_at":28,"published_at":29,"article":30,"tags":34,"podcasts":47,"controls":48},"8cb68ba4-6c88-4518-9ae2-bca3c6136c00","apt29-zero-click-attacks-exploit-unpatched-ios-and-android-flaws","1e820c99-fac0-477c-a244-82c0dddbda69","APT29 Zero-Click Attacks Exploit Unpatched iOS and Android Flaws","Russian APT29 exploited known n-day vulnerabilities — flaws with existing patches — to silently compromise iOS and Android devices through watering hole attacks on legitimate and lookalike websites, requiring no user interaction whatsoever. The core failure was the gap between patch availability and patch deployment: both Apple and Google had issued fixes, but many users and organizations had not applied them, leaving devices exposed. Attackers were able to harvest cookies, credentials, and messaging app databases, demonstrating that even without establishing persistence, transient access can yield highly sensitive intelligence. This incident underscores that n-day vulnerabilities are operationally equivalent to zero-days when patching cadences are slow. Organizations must treat mobile device patch management with the same urgency applied to server and endpoint patching.","**Immediate actions:**\n- Apply all available iOS and Android security updates immediately across managed mobile devices, prioritizing those used to access corporate resources.\n- Block or alert on access to known malicious and lookalike domains using DNS filtering and mobile threat defense (MTD) tools.\n- Audit mobile device management (MDM) policies to enforce minimum OS version requirements and auto-update enforcement.\n\n**Long-term improvements:**\n- Establish a formal mobile patch management policy with defined SLAs (e.g., critical patches applied within 48–72 hours of release).\n- Deploy a Mobile Threat Defense solution capable of detecting exploit attempts and anomalous browser or app behavior on endpoints.\n- Maintain a comprehensive inventory of all mobile devices accessing organizational data to ensure no device is excluded from patch compliance checks.\n\n**Detection measures:**\n- Monitor network traffic and proxy logs for visits to known watering hole or typosquatting domains associated with threat actor infrastructure.\n- Implement logging and alerting for credential and cookie theft indicators, such as anomalous authentication events following mobile device web sessions.\n- Conduct regular threat intelligence reviews to identify newly disclosed n-day vulnerabilities actively being weaponized by APT groups.",[12,13,14,15,16,17,18],"CIS Control 7: Continuous Vulnerability Management","NIST SP 800-53 SI-2: Flaw Remediation","ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities","OWASP A06:2021 Vulnerable and Outdated Components","NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control","MITRE ATT&CK T1566: Phishing","NIS2 Article 21(2)(b)",{"NIS2 Article 21(2)(b)":20,"MITRE ATT&CK T1566: Phishing":21,"NIST SP 800-53 SI-2: Flaw Remediation":22,"OWASP A06:2021 Vulnerable and Outdated Components":23,"CIS Control 7: Continuous Vulnerability Management":24,"ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities":25,"NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control":26},"NIS2 requires entities to implement vulnerability handling and patching policies; the delayed application of available patches on mobile devices represents a direct gap in this obligation that enabled the APT29 campaign.","While zero-click, the watering hole and lookalike domain delivery mechanism mirrors adversarial web-based luring techniques categorized under phishing, highlighting the need for domain monitoring and user traffic controls.","SI-2 requires organizations to identify, report, and correct information system flaws; applying vendor-issued patches promptly would have directly prevented these n-day exploits from succeeding.","The attack succeeded because device operating system components were outdated; this OWASP risk category directly addresses the danger of running software with known, patchable vulnerabilities.","APT29 exploited patched n-day vulnerabilities, meaning continuous scanning and enforced patch deadlines on mobile devices would have closed the window of exposure before exploitation.","This control mandates timely identification and remediation of technical vulnerabilities, which if followed for mobile platforms, would have ensured patches were applied before APT29 leveraged them.","Stolen cookies and credentials harvested in these attacks could enable further unauthorized access, making strong session management and re-authentication controls essential mitigating factors.","published","2026-11-04T10:20:26.162087+00:00","2026-11-04T10:20:26.144+00:00",{"id":7,"url":31,"slug":32,"title":33},"https:\u002F\u002Fwww.bleepingcomputer.com\u002Fnews\u002Fsecurity\u002Fhackers-use-n-day-exploits-in-zero-click-attacks-on-ios-android-devices\u002F","hackers-use-n-day-exploits-in-zero-click-attacks-on-ios-android-devices-e3fd45","Hackers use n-day exploits in zero-click attacks on iOS, Android devices",[35,41],{"id":36,"name":37,"slug":38,"description":39,"color":40},"05757c8d-6b93-4194-b35d-7359e7d33b0e","Vulnerability Management","vulnerability-management","Missing scans, no risk prioritization","#fb923c",{"id":42,"name":43,"slug":44,"description":45,"color":46},"af7fce9e-1ce8-4156-93bc-09dcfbfdf29d","Patch Management","patch-management","Unpatched vulnerabilities, delayed updates","#ef4444",[],[49,53,57],{"slug":50,"name":51,"problem":52},"phishing-resistant-mfa","Phishing-resistant MFA","A stolen password, or a user who taps Approve on a push prompt, is no longer enough to log in.",{"slug":54,"name":55,"problem":56},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",{"slug":58,"name":59,"problem":60},"dns-web-filtering","DNS filtering and secure web gateway","Users cannot reach known-malicious sites, and malware cannot phone home."]