Poisoned Source là chiến dịch watering hole quy mô lớn được Sekoia liên kết với APT29, nhóm gián điệp mạng có liên hệ với Nga. Kẻ tấn công xâm nhập website hợp pháp, dựng tên miền giả và đầu độc dịch vụ phân tích web Plerdy để âm thầm nhận diện thiết bị, sau đó phát chuỗi khai thác phù hợp cho iPhone hoặc Android mà không cần người dùng nhấp chuột.
APT29 and the Poisoned Source Profile
APT29 is also tracked as Midnight Blizzard, Cozy Bear, and The Dukes. The cyber threat intelligence community commonly links the group to Russia's Foreign Intelligence Service (SVR). It is known for long-running espionage operations focused on identity theft and strategically valuable information.
Sekoia discovered the activity in mid-October 2026 and published its report on November 4. Based on infrastructure overlaps, operational patterns, victimology, and technical evidence, the company assessed with moderate-to-high confidence that APT29 conducted the campaign. This remains a research attribution, not a legal confirmation of the identity of each operator.
Three Paths Leading Victims into the Trap
Poisoned Source used three infection vectors that converged on the same exploit pipeline. First, the attackers injected JavaScript into legitimate websites, including those of a Ukrainian gas producer, a U.S. chemical industry association, and a Bulgarian military-related organization.
Second, the group set up lookalike domains that functioned as reverse proxies for prominent websites. Sekoia cited domains impersonating the America250 initiative and the Raffles London at The OWO hotel. The real content was relayed while the HTML was modified in transit to add malicious JavaScript, producing a convincing front for targeted social engineering.
The third and broadest vector was a supply-chain attack on Plerdy SEO Tracker. From August 27 to September 3, 2026, Plerdy's tracking code was modified, potentially causing thousands of websites using the component to load the attacker's profiling code. Most affected sites were in Ukraine, and some served military, special-forces, and military-equipment audiences.
UltimateFingerprinter Selects the Right Exploit
The injected JavaScript loaded a component the operators called UltimateFingerprinter. According to Sekoia, it used 61 collectors to create 394 data fields about the device and browser, ranging from canvas, WebGL, fonts, and screen properties to sensors, WebRTC, battery, network, USB, NFC, and Bluetooth data.
The system did not send the same exploit to every visitor. Profiling data went to a delivery server; only when a device met the targeting criteria did the infrastructure return an exploit chain matched to its iOS, Android, and browser version. This filtering both increased the chance of success and reduced exposure of the tools to researchers.
The malicious code was also appended to a minified AngularJS copy, creating a file of about 2.3 MB in which most content did not support the attack. Sekoia assessed that this could frustrate automated analysis or help the file resemble a legitimate library.
N-Day Exploits Do Not Mean Low Risk
The campaign used vulnerabilities for which patches already existed, known as n-days, rather than previously unknown zero-days. Observed iOS chains involved CVE-2025-43529, CVE-2024-27834, CVE-2026-20700, CVE-2025-14174, CVE-2025-43510, and CVE-2025-43520. One branch used DarkSword, an iOS exploit kit previously analyzed by Google Threat Intelligence Group.
On Android, the attackers combined CVE-2026-3910 in Chrome with CVE-2025-27038 in a Qualcomm component. The AndroSnitch tool could then collect Chrome cookies, login data, browsing history, and saved Wi-Fi passwords. The existence of patches does not eliminate risk because slowly updated devices still form a large and valuable target population.
Stolen Data and Intelligence Objectives
At the least invasive level, final payloads targeted browser cookies. Stolen session cookies can let attackers re-enter web services or mailboxes without knowing the password, particularly when servers do not force reauthentication after detecting anomalies.
More capable iOS chains targeted WhatsApp and Telegram databases, Keychain data, location information, and photos. On Android, Wi-Fi passwords and Chrome data could help expand an operation from the phone to other networks or accounts. The analyzed payloads did not establish persistence; rebooting could stop a running process, but an unpatched victim could be exploited again after revisiting a poisoned source.
The Shift from Watering Holes to the Web Supply Chain
A traditional watering-hole operation requires attackers to compromise individual websites frequented by their targets. Compromising a third-party analytics provider changes the equation: one legitimate JavaScript file embedded by thousands of sites becomes a shared distribution point. Attackers can expand their reach without controlling each site.
This also creates a trust problem across the web ecosystem. A site owner may secure its own server yet still be drawn into an attack through an external component. Visitors cannot recognize the compromise visually because the page continues to render normally while profiling and exploitation occur in the background.
What Should Organizations and Users Do?
- Cập nhật iOS, Android, Chrome và các thành phần hệ thống lên phiên bản bảo mật mới nhất; thay thế thiết bị không còn được nhà sản xuất hỗ trợ.
- Khởi động lại thiết bị nếu nghi ngờ bị nhắm mục tiêu, đồng thời thu hồi phiên đăng nhập, đổi thông tin xác thực quan trọng và kiểm tra hoạt động tài khoản bất thường.
- Với website, kiểm kê mọi JavaScript bên thứ ba, chỉ cho phép nguồn cần thiết qua Content Security Policy và cân nhắc Subresource Integrity khi kiến trúc cho phép.
- Giám sát thay đổi tệp, tên miền mới, chuyển hướng bất thường và kết nối tới hạ tầng không quen thuộc; không xem thành phần phân tích hay tiếp thị là vùng ít rủi ro.
- Đội ứng cứu cần liên kết nhật ký web, DNS, proxy, thiết bị di động và danh tính để phát hiện hành vi đánh cắp cookie hoặc tái sử dụng phiên.
Lessons from the Poisoned Source Profile
Poisoned Source shows that patched vulnerabilities can remain effective intelligence weapons when paired with broad distribution and precise target selection. Defense must therefore extend beyond protecting the origin website: organizations need to manage JavaScript supply-chain risk, shorten mobile patch cycles, and treat session cookies as sensitive credentials.
VNCyberS compiled from Sekoia, BleepingComputer, and The Hacker News
Tiếng Việt
English