Clearance Incident Response. Free through May 1, 2027, so you have time to patch.Estimate your Blast Radius in 60 secondsEstimate

aviatrix logoAviatrix
Under Active Attack

Executive Summary

Between August and October 2026, the Russia-linked threat actor APT29 conducted a sophisticated multi-vector mobile exploitation campaign dubbed 'Poisoned Source.' Attackers compromised legitimate websites, registered lookalike domains, and injected malicious JavaScript into the Plerdy SEO Tracker supply chain (affecting the widely loaded script at a.plerdy[.]com) to deliver platform-specific N-day exploit chains to iOS and Android users. iOS victims were targeted with the DarkSword exploit kit across CVE-2025-43529, CVE-2026-20700, and related vulnerabilities, enabling full device data exfiltration including iMessages, iCloud Keychain, and Wi-Fi passwords. Android users were served a Chrome-targeting chain exploiting CVE-2026-3910 and CVE-2025-27038, culminating in deployment of the AndroSnitch infostealer.

This campaign illustrates the accelerating commoditization of commercial surveillance vendor exploit frameworks. The confirmed reuse of DarkSword across both nation-state and criminal actors, combined with the Coruna kit's broad availability following public disclosure, signals a structural shift: advanced mobile exploitation is no longer exclusive to well-resourced state programs, raising the risk floor for enterprises, government agencies, and critical infrastructure operators globally.

Why This Matters Now

Mobile endpoints have become primary targets for nation-state and criminal actors alike, yet most enterprise security architectures lack visibility into mobile traffic flows and browser-level exploit delivery. With DarkSword and Coruna kits now accessible to multiple threat actors and distributed via supply chain compromise, expired analytics domains, and malvertising, organizations face a rapidly widening attack surface that traditional perimeter and endpoint controls were not designed to address.

Attack Path Analysis

Related CVEs

MITRE ATT&CK® Techniques

Potential Compliance Exposure

Sector Implications

Sources

Frequently Asked Questions

Between August 27 and September 3, 2026, APT29 injected malicious JavaScript into the Plerdy SEO Tracker script hosted at a.plerdy[.]com. Any website loading this script unknowingly served a device-profiling payload to visitors, which then delivered platform-specific iOS or Android exploit chains without requiring any user interaction beyond visiting the page.

Cloud Native Security Fabric Mitigations and ControlsCNSF

Based on the attack progression modeled above, these are the defensive controls that would constrain each stage.

Aviatrix Zero Trust CNSF is relevant here because this supply chain watering hole campaign relied on unrestricted outbound paths and uncontrolled east-west reachability to propagate exploit payloads and exfiltrate harvested credentials from compromised devices. By enforcing segmented egress policies and workload-level access controls across cloud-hosted environments, CNSF would likely reduce the blast radius available to attackers operating through compromised third-party analytics infrastructure.

Initial Compromise

Control: Cloud Native Security Fabric (CNSF)

Mitigation: CNSF fabric-level visibility across cloud-hosted web properties would likely constrain the reachability of injected third-party scripts to sensitive internal workloads, reducing the scope of what compromised analytics infrastructure could touch within protected cloud environments.

Privilege Escalation

Control: Zero Trust Segmentation

Mitigation: Zero Trust segmentation enforced at the workload and identity layer would likely reduce the privilege scope available to exploit chains attempting to pivot from browser-level execution into protected data tiers or cloud-connected backend services.

Lateral Movement

Control: East-West Traffic Security

Mitigation: East-west traffic enforcement would likely constrain the reachability of sessions originating from compromised personal devices into cloud-hosted enterprise workloads, reducing how far harvested credentials could be leveraged to move across segmented cloud environments.

Command & Control

Control: Multicloud Visibility & Control

Mitigation: Multicloud visibility and control applied across egress paths would likely reduce the ability of malicious JavaScript to reach hardcoded attacker-controlled telemetry endpoints undetected, constraining the command and control reachability available to payload delivery infrastructure.

Exfiltration

Control: Egress Security & Policy Enforcement

Mitigation: Egress security policy enforcement would likely reduce the available outbound paths for bulk data exfiltration to hardcoded external telemetry endpoints, constraining the volume and reach of credential and sensitive data transfers leaving cloud-adjacent environments.

Impact (Mitigations)

Even with prior-stage controls applied, residual risk would remain around harvested device credentials that exist entirely outside cloud enforcement boundaries, though the blast radius of follow-on enterprise intrusions would likely be meaningfully reduced by segmented access policies constraining what those credentials could reach.

Impact at a Glance

Affected Business Functions

  • Mobile Device Security and Endpoint Integrity
  • Sensitive Government and Military Communications
  • Diplomatic and Intelligence Personnel Data Protection
  • Supply Chain Software Integrity (Web Analytics Services)
Operational Disruption

Estimated downtime: N/A

Financial Impact

Estimated loss: N/A

Data Exposure

Highly sensitive data exfiltrated from compromised iOS and Android mobile devices of high-value targets including military personnel, government officials, diplomatic staff, and individuals associated with defense and chemical industry organizations across the U.S., Ukraine, Czech Republic, and Bulgaria. Exposed data categories include: SMS messages and iMessages, Apple Mail databases, voicemail, WhatsApp and Telegram message databases, iCloud Keychain credentials, Wi-Fi passwords, contact lists, call history, Safari browser cookies and history, photos, Apple Health records, Calendar entries, iCloud Drive files, and Chrome browser cookies and session data on Android. The Plerdy SEO Tracker supply chain compromise (August 27 to September 3, 2026) introduced the malicious JavaScript loader to all websites using the analytics service, potentially extending exposure beyond the directly targeted high-value sites to any visitor using a vulnerable iOS or Android device during that window.

Recommended Actions

  • • Deploy Egress Security & Policy Enforcement with FQDN filtering to block outbound connections to unrecognized or newly registered domains such as ad.starx-net[.]com and ad-track[.]live; enforce allowlist-based egress policies so that workloads and managed endpoints can only reach approved telemetry and analytics destinations, preventing exfiltration to hardcoded attacker endpoints.
  • • Enable Inline IPS (Suricata) with up-to-date signatures covering known N-day exploit traffic patterns associated with DarkSword, Coruna, CVE-2026-3910, and CVE-2025-27038; inline inspection of outbound JavaScript delivery and exploit payload traffic can identify and block malicious payloads before device compromise occurs where traffic is not end-to-end encrypted at the mobile layer.
  • • Apply Zero Trust Segmentation and Cloud Firewall (ACF) controls to restrict third-party analytics and supply chain JavaScript origins; enforce content-security-policy-equivalent network-layer controls that limit which external script domains can be loaded by internal web properties, reducing the attack surface of supply chain injection via compromised CDN or analytics providers like Plerdy.
  • • Leverage Multicloud Visibility & Control with anomaly detection to baseline expected egress traffic patterns from web-facing assets and alert on novel high-volume POST requests to non-standard ports (e.g., port 8881) or newly observed external domains; centralized traffic observability across multi-cloud and hybrid environments enables rapid detection of C2 telemetry beaconing indicative of watering hole payload delivery.
  • • Enforce Encrypted Traffic (HPE) inspection policies and East-West Traffic Security controls to ensure that data in transit between compromised endpoints and internal resources cannot be silently intercepted; combine with device posture validation at network access points so that devices exhibiting indicators of mobile exploitation (unexpected credential store access, anomalous outbound data volumes) are quarantined before harvested credentials can be used for lateral movement into enterprise or government network segments.

Secure the Paths Between Cloud Workloads

A cloud-native security fabric that enforces Zero Trust across workload communication—reducing attack paths, compliance risk, and operational complexity.

Stop Advanced ThreatsFree Containment AssessmentUnder Active Attack?
Cta pattren Image