Kremlin-Linked Hackers Used Fake Hotel and Anniversary Sites to Pwn Your Phone
Researchers at Sekoia have linked a sophisticated mobile hacking campaign to Russia's Foreign Intelligence Service, with moderate-to-high confidence. The attackers targeted visitors to a range of websites, including one tied to America's upcoming 250th independence anniversary celebrations, using a combination of watering hole attacks, reverse proxies, and a compromised Ukrainian web analytics supply chain.
The mechanics were straightforward enough. When an iPhone or Android user visited one of potentially hundreds of affected sites, injected JavaScript quietly profiled their device. Depending on what it found, the payload was tailored accordingly, aiming to lift browser cookies, Wi-Fi credentials, or in more aggressive cases, full device data. No clicks required.
One of the more eyebrow-raising targets was america250.org, a non-partisan organisation involving lawmakers, business executives, and at least one former Trump administration figure. The attackers registered america250[.]holiday as a lookalike domain, using it as a reverse proxy to serve real content from the legitimate site while silently injecting malicious JavaScript into it. Sekoia suggested the site may have been chosen partly as a pretext for invitation-themed spear-phishing, riding on the credibility of a high-profile national event.
A second proxy site, theowo[.]club, impersonated Raffles London at The OWO, a luxury hotel sitting uncomfortably close to the Ministry of Defence and 10 Downing Street. Ukrainian President Zelenskyy reportedly stayed there during an October 14 visit. The implication being that diplomatic staff and high-value guests might have been the real quarry.
Beyond the proxy sites, the campaign also ran through compromised legitimate websites, including a major Ukrainian gas production company, and through a Ukrainian web analytics service with reach across thousands of sites. That last one is the supply chain angle, and it is the kind of infection vector that scales nastily.
The exploit kit named in the report is DarkSword, an iOS tool previously attributed to customers of PARS Defense, a Turkish commercial surveillance vendor. At least two other threat actors have used it, according to Google researchers. Sekoia noted the broader campaign deployed two additional unnamed exploit chains alongside it.
Crucially, none of the vulnerabilities exploited here were zero-days. These were all n-days, flaws that had already been patched. The attacks only landed on devices running outdated versions of iOS or Android. Which is cold comfort, given how many people never update.
Sekoia's attribution to APT29, the suspected SVR-linked group, rests on target selection patterns and technical overlaps with previous operations linked to that actor. Russia has not commented, which will surprise nobody.