Suspected Kremlin-linked iOS and Android exploits used patched flaws to target mobile data - The Cryptonomist

The campaign combined compromised websites with impersonated pages, including a US anniversary site and a London luxury hotel's website, to deliver attacks that required no further interaction from visitors. Security firm Sekoia assessed that the attackers were linked to Russia's Foreign Intelligence Service, citing target profiles and similarities to an earlier attack attributed to APT29.

Exploiting patched flaws

The iOS and Android exploits targeted vulnerabilities for which patches already existed, known as "n-days," rather than previously unknown vulnerabilities. The campaign specifically targeted outdated versions of the mobile operating systems, taking advantage of users who hadn't installed the latest security updates.

Impersonated websites

Attackers used reverse proxies to reproduce legitimate website content while adding malicious JavaScript. One domain, america250[.]holiday, proxied america250.org, a website associated with the 250th anniversary of American independence. Another, theowo[.club], reproduced the website of Raffles of London OWO, a luxury hotel near sensitive UK government institutions.

Targeted profiling

The injected JavaScript first examined the visitor's browser and device before attackers selected an exploit chain suited to the platform. Three infection routes were identified: direct JavaScript injection, attacker-controlled proxy domains, and a supply-chain compromise involving a Ukrainian web analytics service that served thousands of websites.

Diplomatic targets

Several targeted sites had connections to Russia's war against Ukraine or locations near sensitive UK government institutions. The impersonation of the London hotel potentially served attempts to reach diplomatic delegations and high-profile guests, with Ukrainian President Volodymyr Zelenskyy having stayed there during an October 14 visit.