{"id":2186,"date":"2026-11-05T07:20:39","date_gmt":"2026-11-05T00:20:39","guid":{"rendered":"https:\/\/vncybers.vn\/ho-so-poisoned-source-apt29-phan-tich-web-iphone-android\/"},"modified":"2026-11-05T07:20:39","modified_gmt":"2026-11-05T00:20:39","slug":"poisoned-source-apt29-web-analytics-iphone-android","status":"publish","type":"post","link":"https:\/\/vncybers.vn\/en\/ho-so-poisoned-source-apt29-phan-tich-web-iphone-android\/","title":{"rendered":"Poisoned Source Profile: APT29 Turns Web Analytics into an iPhone and Android Trap"},"content":{"rendered":"

Poisoned Source<\/strong> l\u00e0 chi\u1ebfn d\u1ecbch watering hole quy m\u00f4 l\u1edbn \u0111\u01b0\u1ee3c Sekoia li\u00ean k\u1ebft v\u1edbi APT29, nh\u00f3m gi\u00e1n \u0111i\u1ec7p m\u1ea1ng c\u00f3 li\u00ean h\u1ec7 v\u1edbi Nga. K\u1ebb t\u1ea5n c\u00f4ng x\u00e2m nh\u1eadp website h\u1ee3p ph\u00e1p, d\u1ef1ng t\u00ean mi\u1ec1n gi\u1ea3 v\u00e0 \u0111\u1ea7u \u0111\u1ed9c d\u1ecbch v\u1ee5 ph\u00e2n t\u00edch web Plerdy \u0111\u1ec3 \u00e2m th\u1ea7m nh\u1eadn di\u1ec7n thi\u1ebft b\u1ecb, sau \u0111\u00f3 ph\u00e1t chu\u1ed7i khai th\u00e1c ph\u00f9 h\u1ee3p cho iPhone ho\u1eb7c Android m\u00e0 kh\u00f4ng c\u1ea7n ng\u01b0\u1eddi d\u00f9ng nh\u1ea5p chu\u1ed9t.<\/p>\n

\"Diagram
Research diagram of the Poisoned Source campaign. Source: Sekoia.<\/figcaption><\/figure>\n

APT29 and the Poisoned Source Profile<\/h2>\n

APT29 is also tracked as Midnight Blizzard, Cozy Bear, and The Dukes. The cyber threat intelligence community commonly links the group to Russia's Foreign Intelligence Service (SVR). It is known for long-running espionage operations focused on identity theft and strategically valuable information.<\/p>\n

Sekoia discovered the activity in mid-October 2026 and published its report on November 4. Based on infrastructure overlaps, operational patterns, victimology, and technical evidence, the company assessed with moderate-to-high confidence that APT29 conducted the campaign. This remains a research attribution, not a legal confirmation of the identity of each operator.<\/p>\n

Three Paths Leading Victims into the Trap<\/h2>\n

Poisoned Source used three infection vectors that converged on the same exploit pipeline. First, the attackers injected JavaScript into legitimate websites, including those of a Ukrainian gas producer, a U.S. chemical industry association, and a Bulgarian military-related organization.<\/p>\n

Second, the group set up lookalike domains that functioned as reverse proxies for prominent websites. Sekoia cited domains impersonating the America250 initiative and the Raffles London at The OWO hotel. The real content was relayed while the HTML was modified in transit to add malicious JavaScript, producing a convincing front for targeted social engineering.<\/p>\n

The third and broadest vector was a supply-chain attack on Plerdy SEO Tracker. From August 27 to September 3, 2026, Plerdy's tracking code was modified, potentially causing thousands of websites using the component to load the attacker's profiling code. Most affected sites were in Ukraine, and some served military, special-forces, and military-equipment audiences.<\/p>\n

UltimateFingerprinter Selects the Right Exploit<\/h2>\n

The injected JavaScript loaded a component the operators called UltimateFingerprinter. According to Sekoia, it used 61 collectors to create 394 data fields about the device and browser, ranging from canvas, WebGL, fonts, and screen properties to sensors, WebRTC, battery, network, USB, NFC, and Bluetooth data.<\/p>\n

The system did not send the same exploit to every visitor. Profiling data went to a delivery server; only when a device met the targeting criteria did the infrastructure return an exploit chain matched to its iOS, Android, and browser version. This filtering both increased the chance of success and reduced exposure of the tools to researchers.<\/p>\n

The malicious code was also appended to a minified AngularJS copy, creating a file of about 2.3 MB in which most content did not support the attack. Sekoia assessed that this could frustrate automated analysis or help the file resemble a legitimate library.<\/p>\n

N-Day Exploits Do Not Mean Low Risk<\/h2>\n

The campaign used vulnerabilities for which patches already existed, known as n-days, rather than previously unknown zero-days. Observed iOS chains involved CVE-2025-43529, CVE-2024-27834, CVE-2026-20700, CVE-2025-14174, CVE-2025-43510, and CVE-2025-43520. One branch used DarkSword, an iOS exploit kit previously analyzed by Google Threat Intelligence Group.<\/p>\n

On Android, the attackers combined CVE-2026-3910 in Chrome with CVE-2025-27038 in a Qualcomm component. The AndroSnitch tool could then collect Chrome cookies, login data, browsing history, and saved Wi-Fi passwords. The existence of patches does not eliminate risk because slowly updated devices still form a large and valuable target population.<\/p>\n

Stolen Data and Intelligence Objectives<\/h2>\n

At the least invasive level, final payloads targeted browser cookies. Stolen session cookies can let attackers re-enter web services or mailboxes without knowing the password, particularly when servers do not force reauthentication after detecting anomalies.<\/p>\n

More capable iOS chains targeted WhatsApp and Telegram databases, Keychain data, location information, and photos. On Android, Wi-Fi passwords and Chrome data could help expand an operation from the phone to other networks or accounts. The analyzed payloads did not establish persistence; rebooting could stop a running process, but an unpatched victim could be exploited again after revisiting a poisoned source.<\/p>\n

The Shift from Watering Holes to the Web Supply Chain<\/h2>\n

A traditional watering-hole operation requires attackers to compromise individual websites frequented by their targets. Compromising a third-party analytics provider changes the equation: one legitimate JavaScript file embedded by thousands of sites becomes a shared distribution point. Attackers can expand their reach without controlling each site.<\/p>\n

This also creates a trust problem across the web ecosystem. A site owner may secure its own server yet still be drawn into an attack through an external component. Visitors cannot recognize the compromise visually because the page continues to render normally while profiling and exploitation occur in the background.<\/p>\n

What Should Organizations and Users Do?<\/h2>\n
    \n
  • C\u1eadp nh\u1eadt iOS, Android, Chrome v\u00e0 c\u00e1c th\u00e0nh ph\u1ea7n h\u1ec7 th\u1ed1ng l\u00ean phi\u00ean b\u1ea3n b\u1ea3o m\u1eadt m\u1edbi nh\u1ea5t; thay th\u1ebf thi\u1ebft b\u1ecb kh\u00f4ng c\u00f2n \u0111\u01b0\u1ee3c nh\u00e0 s\u1ea3n xu\u1ea5t h\u1ed7 tr\u1ee3.<\/li>\n
  • Kh\u1edfi \u0111\u1ed9ng l\u1ea1i thi\u1ebft b\u1ecb n\u1ebfu nghi ng\u1edd b\u1ecb nh\u1eafm m\u1ee5c ti\u00eau, \u0111\u1ed3ng th\u1eddi thu h\u1ed3i phi\u00ean \u0111\u0103ng nh\u1eadp, \u0111\u1ed5i th\u00f4ng tin x\u00e1c th\u1ef1c quan tr\u1ecdng v\u00e0 ki\u1ec3m tra ho\u1ea1t \u0111\u1ed9ng t\u00e0i kho\u1ea3n b\u1ea5t th\u01b0\u1eddng.<\/li>\n
  • V\u1edbi website, ki\u1ec3m k\u00ea m\u1ecdi JavaScript b\u00ean th\u1ee9 ba, ch\u1ec9 cho ph\u00e9p ngu\u1ed3n c\u1ea7n thi\u1ebft qua Content Security Policy v\u00e0 c\u00e2n nh\u1eafc Subresource Integrity khi ki\u1ebfn tr\u00fac cho ph\u00e9p.<\/li>\n
  • Gi\u00e1m s\u00e1t thay \u0111\u1ed5i t\u1ec7p, t\u00ean mi\u1ec1n m\u1edbi, chuy\u1ec3n h\u01b0\u1edbng b\u1ea5t th\u01b0\u1eddng v\u00e0 k\u1ebft n\u1ed1i t\u1edbi h\u1ea1 t\u1ea7ng kh\u00f4ng quen thu\u1ed9c; kh\u00f4ng xem th\u00e0nh ph\u1ea7n ph\u00e2n t\u00edch hay ti\u1ebfp th\u1ecb l\u00e0 v\u00f9ng \u00edt r\u1ee7i ro.<\/li>\n
  • \u0110\u1ed9i \u1ee9ng c\u1ee9u c\u1ea7n li\u00ean k\u1ebft nh\u1eadt k\u00fd web, DNS, proxy, thi\u1ebft b\u1ecb di \u0111\u1ed9ng v\u00e0 danh t\u00ednh \u0111\u1ec3 ph\u00e1t hi\u1ec7n h\u00e0nh vi \u0111\u00e1nh c\u1eafp cookie ho\u1eb7c t\u00e1i s\u1eed d\u1ee5ng phi\u00ean.<\/li>\n<\/ul>\n

    Lessons from the Poisoned Source Profile<\/h2>\n

    Poisoned Source shows that patched vulnerabilities can remain effective intelligence weapons when paired with broad distribution and precise target selection. Defense must therefore extend beyond protecting the origin website: organizations need to manage JavaScript supply-chain risk, shorten mobile patch cycles, and treat session cookies as sensitive credentials.<\/p>\n

    VNCyberS<\/strong> compiled from Sekoia, BleepingComputer, and The Hacker News<\/em><\/p>","protected":false},"excerpt":{"rendered":"

    Poisoned Source l\u00e0 chi\u1ebfn d\u1ecbch watering hole quy m\u00f4 l\u1edbn \u0111\u01b0\u1ee3c Sekoia li\u00ean k\u1ebft v\u1edbi APT29, nh\u00f3m gi\u00e1n \u0111i\u1ec7p m\u1ea1ng c\u00f3 li\u00ean h\u1ec7 v\u1edbi Nga. K\u1ebb t\u1ea5n c\u00f4ng x\u00e2m nh\u1eadp website h\u1ee3p ph\u00e1p, d\u1ef1ng t\u00ean mi\u1ec1n gi\u1ea3 v\u00e0 \u0111\u1ea7u \u0111\u1ed9c d\u1ecbch v\u1ee5 ph\u00e2n t\u00edch web Plerdy \u0111\u1ec3 \u00e2m th\u1ea7m nh\u1eadn di\u1ec7n thi\u1ebft b\u1ecb, sau \u0111\u00f3 […]<\/p>\n","protected":false},"author":2,"featured_media":2185,"comment_status":"","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"inline_featured_image":false,"footnotes":""},"categories":[70],"tags":[46,16,1070,1075,1074,94,1071,1072,1069,1073],"class_list":["post-2186","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-ho-so","tag-an-ninh-mang","tag-android","tag-apt29","tag-chuoi-cung-ung-javascript","tag-darksword","tag-ios","tag-midnight-blizzard","tag-plerdy","tag-poisoned-source","tag-watering-hole"],"_links":{"self":[{"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/posts\/2186","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/comments?post=2186"}],"version-history":[{"count":0,"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/posts\/2186\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/media\/2185"}],"wp:attachment":[{"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/media?parent=2186"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/categories?post=2186"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/tags?post=2186"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}