APT29's DarkSword Watering-Hole Campaign: How Russia's SVR Turned Analytics Scripts Into Mobile Spy Tools
Executive Summary
Executive Summary In 2026, Russia's APT29 (Cozy Bear / Midnight Blizzard) executed a multi-vector watering-hole campaign that compromised legitimate websites—including a Ukrainian analytics provider (Plerdy), a US chemical-industry trade association, and a Bulgarian military site—as well as lookalike domains impersonating high-profile brands. Malicious JavaScript fingerprinted visiting iOS and Android devices, then delivered tailored exploit chains exploiting CVE-2025-43529, CVE-2024-27834, and the multi-stage DarkSword kit to harvest SMS, credentials, messaging-app data, and authentication tokens from thousands of unpatched mobile devices across Ukraine, Europe, and the United States.
The campaign signals a structural shift in nation-state tradecraft: packaged n-day mobile exploit kits sourced from commercial surveillance vendors are lowering the barrier to mass mobile espionage. As APT29 moves beyond traditional endpoint and cloud targets toward supply-chain injection into widely used analytics scripts, organizations must treat third-party JavaScript dependencies and unmanaged mobile endpoints as first-class attack surfaces.
Why This Matters Now
Why This Matters NowCommercial exploit kits like DarkSword are proliferating among state-sponsored actors, dramatically lowering the cost of large-scale mobile surveillance. With APT29 now weaponizing supply-chain analytics scripts that touch thousands of websites simultaneously, any organization relying on third-party tracking code or operating unmanaged mobile fleets faces immediate, elevated risk of credential and data exfiltration at scale.
Attack Path Analysis
Attack Path AnalysisAPT29 executed a multi-vector watering-hole campaign by compromising legitimate websites and a widely-used Ukrainian analytics supply chain (Plerdy) to inject malicious JavaScript fingerprinting code, silently profiling thousands of mobile visitors across iOS and Android. Victims with unpatched devices were then served tailored exploit chains (including the DarkSword kit) that escalated privileges on-device, established covert C2 communication, and exfiltrated a broad range of sensitive personal and credential data, with the full impact being large-scale mobile intelligence collection supporting Russian SVR espionage objectives.
Kill Chain Progression
Kill Chain ProgressionThis analysis maps confirmed threat intelligence to the full cloud kill chain to show where defensive gaps would emerge as an attack progresses.
Initial Compromise
Description
DescriptionAPT29 compromised legitimate third-party websites (a US chemical trade association site, a Ukrainian gas producer site, a Bulgarian military site) and injected malicious JavaScript into the Plerdy analytics supply chain script, which is loaded by thousands of Ukrainian and other websites. Lookalike domains impersonating legitimate sites (America250, Raffles hotel) were also created. Any mobile visitor to these watering holes was silently exposed to device-fingerprinting JavaScript that collected browser and OS version data without user interaction.
Related CVEs
Related CVEsCVE-2024-27834
CVSS 5.5A vulnerability in WebKit allows an attacker with arbitrary read and write capability to bypass Pointer Authentication on iOS devices, enabling cookie theft and potential code execution.
Affected Products:
Apple iOS – < 17.5, 16.x <= 16.7.x
Apple Safari – < 17.5
Exploit Status:
exploited in the wild
MITRE ATT&CK® Techniques
MITRE ATT&CK® TechniquesDrive-by Compromise
Compromise Software Supply Chain
Command and Scripting Interpreter: JavaScript
Gather Victim Host Information
Exploitation for Client Execution
Input Capture: Web Portal Capture
Exfiltration Over C2 Channel
Compromise Infrastructure: Domains
Potential Compliance Exposure
Potential Compliance ExposureMapping incident impact across multiple compliance frameworks.
NIST SP 800-53 Rev. 5 – Malicious Code Protection / Spam and Spyware Protection
Control ID: SI-3 / SI-8
CISA Zero Trust Maturity Model 2.0 – Continuous Device Validation and Telemetry
Control ID: Device Pillar — Device Visibility & Analytics
NIS2 Directive (EU) 2022/2555 – Supply Chain Security and Vulnerability Handling
Control ID: Article 21 — Cybersecurity Risk Management Measures
PCI DSS 4.0 – Payment Page Script Integrity and Tamper Detection
Control ID: Requirement 6.4.3 / 11.6.1
GDPR (EU) 2016/679 – Security of Processing / Breach Notification
Control ID: Article 32 / Article 33
DORA (EU) 2022/2554 – Third-Party ICT Service Provider Risk Assessment
Control ID: Article 28 — ICT Third-Party Risk Management
Sector Implications
Sector ImplicationsIndustry-specific impact of the vulnerabilities, including operational, regulatory, and cloud security risks.
Government Administration
APT29's mobile watering-hole campaign directly targets government agencies via supply-chain and infostealer vectors, risking credential exfiltration and lateral movement across sensitive administrative networks requiring Zero Trust Segmentation controls.
Information Technology/IT
Supply-chain compromise of Plerdy analytics scripts exposes IT providers and downstream clients to DarkSword exploit chains, demanding Egress Security, Multicloud Visibility, and Inline IPS enforcement mapped to NIST.800-53.SC-7 and PCI.4.0.
Health Care / Life Sciences
An Australian medical clinic confirmed among APT29 watering-hole victims; mobile infostealer exfiltration of credentials and messages violates HIPAA.164.312(e)(1), underscoring urgent need for Encrypted Traffic and East-West Traffic Security controls.
Think Tanks
APT29 explicitly prioritizes think tanks for intelligence gathering; fingerprinting-driven mobile exploitation and data exfiltration of communications align with ZTMM.Data and NIST.CSF.PR.DS-5 egress policy enforcement gaps.
Sources
Sources- APT29's Watering Holes Target Thousands of Mobile Usershttps://www.darkreading.com/mobile-security/apt29-watering-holes-target-mobile-usersVerified
- CISA Known Exploited Vulnerabilities Cataloghttps://www.cisa.gov/known-exploited-vulnerabilities-catalogVerified
- NVD Detail: CVE-2024-27834https://nvd.nist.gov/vuln/detail/CVE-2024-27834Verified
- Apple Security Advisory HT214106 - iOS 17.5 and iPadOS 17.5https://support.apple.com/en-us/HT214106Verified
- CISA Advisory on APT29 / SVR Cyber Operationshttps://www.cisa.gov/news-events/cybersecurity-advisories/aa21-116aVerified
- Sekoia Threat Intelligence Blog - APT29 Mobile Watering Hole Campaignhttps://blog.sekoia.ioVerified
- MITRE ATT&CK - APT29 Group Profilehttps://attack.mitre.org/groups/G0016/Verified
Frequently Asked Questions
Frequently Asked QuestionsCloud Native Security Fabric Mitigations and ControlsCNSF
Based on the attack progression modeled above, these are the defensive controls that would constrain each stage.
Aviatrix Zero Trust CNSF is relevant to this incident because APT29's campaign relied on harvested mobile credentials to pivot into enterprise cloud environments, VPNs, and SaaS platforms — exactly the east-west and egress paths that segmentation and identity-aware policy enforcement are designed to constrain. While the initial mobile device compromise falls outside cloud fabric control, the downstream blast radius into organizational infrastructure would likely be meaningfully reduced through workload isolation and controlled access boundaries.
Control: Cloud Native Security Fabric (CNSF)
Mitigation: CNSF's fabric-level visibility into outbound web traffic flows from enterprise workloads could limit exposure to known-malicious or newly-registered lookalike domains, reducing the reachability of watering-hole infrastructure from managed cloud environments.
Control: Zero Trust Segmentation
Mitigation: Zero Trust segmentation applied to cloud workloads and identity-scoped access policies could limit the privilege scope available to sessions authenticating with credentials or tokens later stolen from compromised devices, reducing what an attacker could reach even after on-device escalation succeeded.
Control: East-West Traffic Security
Mitigation: East-west enforcement across cloud segments could limit an attacker's ability to move freely between workloads or services using replayed session tokens and stolen credentials, reducing the reachability of sensitive internal resources even when valid-looking authentication material is presented.
Control: Multicloud Visibility & Control
Mitigation: Centralized multicloud visibility into outbound HTTPS flows from cloud-hosted workloads and managed environments could help surface anomalous C2 communication patterns, and policy enforcement could constrain workloads from establishing outbound connections to newly-registered or uncategorized infrastructure used by APT29.
Control: Egress Security & Policy Enforcement
Mitigation: Egress policy enforcement governing outbound traffic from enterprise cloud environments could limit the data paths available for exfiltration, reducing the volume and types of cloud-resident data that could be transmitted to APT29-controlled infrastructure even if device-level compromise had already occurred.
Even after device-level compromise, the residual impact on enterprise cloud infrastructure would likely be reduced in scope — segmented access boundaries and controlled egress paths could constrain how far harvested credentials travel within organizational environments, limiting the attacker's ability to convert mobile intelligence into sustained enterprise network access.
Impact at a Glance
Affected Business Functions
- Mobile Device Endpoint Security
- Diplomatic and Government Communications Intelligence
- Third-Party Website Analytics and Supply Chain Integrity
- Organizational Credential and Authentication Management
Estimated downtime: 7 days
Estimated loss: N/A
Confirmed categories of data exfiltrated from compromised iOS and Android devices include: SMS and iMessages, voicemail recordings, WhatsApp and Telegram messages, stored passwords and authentication tokens, account credentials, call history, contacts, calendar entries, notes, photographs, and other sensitive personal and organizational information. The supply-chain compromise of Plerdy's analytics script potentially exposed visitors across thousands of predominantly Ukrainian websites to fingerprinting and exploit delivery infrastructure. Victims span government agencies, diplomatic organizations, military-related entities, healthcare, energy, and trade association sectors across Ukraine, the United States, Europe, and Australia.
Recommended Actions
Key Takeaways & Next Steps
- • Deploy Egress Security & Policy Enforcement (FQDN/URL filtering): Enforce strict outbound egress policies on all enterprise-connected endpoints and cloud workloads to block communication with unknown or newly registered domains used as APT29 C2 infrastructure; FQDN-based filtering and application-layer policy enforcement would prevent fingerprinting scripts and exploit payloads from reaching attacker-controlled servers.
- • Enable Inline IPS (Suricata) with up-to-date threat signatures: Inline IPS inspection of web traffic traversing enterprise gateways can detect and block known malicious JavaScript injection patterns, DarkSword exploit signatures, and CVE-specific exploit traffic (e.g., CVE-2024-27834, CVE-2025-43529) before payloads reach vulnerable mobile clients connected to corporate networks or VPNs.
- • Enforce Zero Trust Segmentation for mobile and BYOD access: Apply identity-based, least-privilege segmentation policies to restrict what resources mobile devices can access post-authentication; compromised session tokens or stolen credentials harvested from mobile devices should trigger immediate policy re-evaluation at the network layer, limiting lateral movement into cloud environments and SaaS platforms.
- • Activate Multicloud Visibility & Control for anomalous C2 traffic detection: Leverage centralized traffic observability and anomaly detection across hybrid and multi-cloud environments to baseline normal mobile-to-cloud communication patterns and alert on suspicious outbound data flows, repeated fingerprinting-style requests, or bulk data transfers indicative of exfiltration from compromised devices.
- • Apply Encrypted Traffic controls (HPE/IPsec) and monitor supply-chain script integrity: Ensure that third-party analytics and tracking scripts loaded by enterprise or partner websites are integrity-checked (Subresource Integrity headers) and that all data-in-transit between mobile clients and backend services is encrypted end-to-end; additionally, monitor for unauthorized modifications to supply-chain scripts like Plerdy to detect injection attacks before they reach end users.
