Researchers link mobile browser attacks to Russian group APT29

Sekoia researchers identified a campaign using compromised and impersonated websites to deliver attacks against iOS and Android devices without user interaction. They attributed the operation to Russian group APT29 with moderate-to-high confidence. Website code profiled visitors' devices and browsers before a server selected exploits for previously disclosed vulnerabilities. Payloads collected data including cookies, credentials and messaging databases. The operation also compromised Plerdy's SEO tracker, loaded by thousands of websites between August 27 and September 3. Apple and Google have patched all targeted flaws. The analyzed payloads did not establish persistence, so rebooting stopped malicious activity until another visit to a compromised site.