# APT29 Unleashes Mobile Espionage Campaign Targeting Ukraine, US, and Europe Russian state-linked hackers, identified as **APT29** (also known as **Cozy Bear** or **Midnight Blizzard**), have launched a widespread mobile espionage campaign. This group, widely believed to operate on behalf of Russia's foreign intelligence service (**SVR**), targeted users in Ukraine, the United States, and Europe to exfiltrate sensitive data from both **iPhone** and **Android** devices. ## Multi-pronged Attack Vectors According to a report by French cybersecurity firm **Sekoia**, the attackers employed several techniques to reach potential victims. These included planting malicious code on legitimate websites, creating convincing fake versions of popular sites, and compromising a Ukrainian web analytics service. Victims' devices, in some cases, had their passwords, messages, emails, browser data, and other sensitive information stolen without requiring any user interaction or malicious file downloads. ## Initial Discovery and Broader Scope The investigation began after **Sekoia** researchers discovered malicious code on the website of an unnamed Ukrainian gas production company. Further analysis revealed similar compromises affecting a major U.S. chemical industry trade association and a far-right European political party. ### Sophisticated Spoofing Operations The hackers also crafted fraudulent versions of two high-profile websites: **America250**, an initiative commemorating the 250th anniversary of U.S. independence, and **Raffles London at The OWO**, a luxury hotel situated near several British government buildings. These spoofed websites mirrored the legitimate content while simultaneously running malicious code designed to identify visitors using vulnerable devices. Researchers speculate that the fake **America250** site could have lured victims with invitations to anniversary events, while the hotel site might have targeted diplomats and other high-profile guests. ### Compromise of Plerdy Analytics Service In one of the campaign's most impactful operations, the attackers compromised **Plerdy**, a Ukrainian web analytics service utilized by thousands of websites, predominantly in Ukraine. Between late August and early September, malicious code was inserted into a tracking script distributed through **Plerdy**. This compromise potentially exposed visitors browsing hundreds of websites, including those associated with the Ukrainian military, special forces, and manufacturers of drones and other military equipment. The compromised script allowed attackers to identify visitors' devices and software versions before attempting to exploit known security flaws. ## Stealing Smartphone Data The hackers tailored their attack methods based on the device and operating system. ### Targeting iOS Devices For older **iPhones** running **iOS 16**, the attacks aimed to steal browser and application cookies, potentially enabling access to online accounts. A more advanced attack, targeting vulnerable **iPhones** running **iOS 18.5**, could extract a vast array of data, including messages, emails, passwords, contacts, photos, location history, and information from messaging apps like **WhatsApp** and **Telegram**. This advanced attack leveraged a toolkit known as **DarkSword**, a suspected commercially developed surveillance tool capable of extensive data extraction from **iPhones**. **DarkSword** has previously been used by other threat actors in operations targeting users in Saudi Arabia, Turkey, and Malaysia. ### Targeting Android Devices On **Android** devices, the hackers exploited vulnerabilities in older versions of **Google Chrome** to steal browsing data, cookies, and saved Wi-Fi passwords. Unlike some spyware operations, these attacks were designed for data extraction without maintaining long-term access to compromised devices. ## Relying on Patched Vulnerabilities Crucially, all three attack methods relied on previously discovered vulnerabilities that **Apple** and **Google** had already patched before the campaign began. Researchers confirmed that the attacks did not exploit previously unknown software flaws (zero-days) and would be ineffective against fully updated devices. **Sekoia** has not yet determined the total number of successfully compromised smartphones or the extent of information obtained. The firm is collaborating with computer emergency response teams in affected countries to identify potential victims and disrupt the attackers' infrastructure.