APT29 Poisoned an Analytics Script to Hack Phones Across Ukraine

Russia’s APT29 poisoned a Ukrainian web analytics script for a week this summer, quietly loading a phone-exploit kit onto thousands of mostly Ukrainian websites, according to new research from Sekoia. The same operation hacked high-profile sites in the US, Ukraine, the Czech Republic and Bulgaria and ran lookalike copies of the America250 site and a London luxury hotel, all to steal cookies, Wi-Fi passwords and in some cases a phone’s entire contents. Every exploit was already patched; one of them, Apple’s CVE-2024-27834, landed on CISA’s exploited list on Nov. 4.

static.flux-telemetry[.]com (delivery, 109.104.106[.]107)
edge-ord.clouds-stacks[.]com (delivery load balancer, 95.133.231[.]28)
ad.starx-net[.]com (exfiltration, 195.58.140[.]105, port 8881)
adsprism-stat[.]com (delivery)
ads-it-assets[.]com
cdn.adv-static[.]com
wpvortex-mod[.]com
assets-int[.]com
america250[.]holiday (lookalike reverse proxy)
theowo[.]club (lookalike reverse proxy)

5b4c8fea5cbcee273e8d830f52-temfp.js (UltimateFingerprinter)
VDGH_TOKEN_REF (iOS chain marker cookie)
SHA256 387a7fb768db1350a9788d9704e7a72abe07152734e0ff026af72b417e36268c (AndroSnitch)

Source article: Poisoned Source: APT29 watering holes target mobile devices with n-day exploits
Publisher: Sekoia Threat Detection & Research (Amaury Garçon, Félix Aime, Robin Kwiatkowski, TDR Team)
Published: November 4, 2026
URL: https://www.sekoia.com/blog/poisoned-source-apt29-watering-holes-targets-mobile-devices-with-n-day-exploits

Executive Summary

Sekoia TDR attributes, with moderate to high confidence, a large watering-hole campaign uncovered in mid-October 2026 to APT29 (also tracked as Midnight Blizzard, Cozy Bear and The Dukes), the intrusion set widely attributed to Russia’s Foreign Intelligence Service (SVR), or to one of its subgroups. The operators used three delivery vectors: JavaScript injected into the templates or existing script files of compromised legitimate websites in Ukraine, the US, the Czech Republic and Bulgaria; attacker-registered lookalike domains (america250[.]holiday, theowo[.]club) acting as reverse proxies in front of the real America250 and Raffles London at The OWO sites and patching a script tag into each page; and a one-week supply-chain compromise (Aug. 27 to Sept. 3, 2026) of the Ukrainian Plerdy SEO tracker script, loaded by thousands of mostly Ukrainian sites including defense and military-recruitment sites. Every vector loads the same fingerprinting script, 5b4c8fea5cbcee273e8d830f52-temfp.js (“UltimateFingerprinter”), hidden behind a 2.3 MB AngularJS copy, which posts a 394-field device profile to static.flux-telemetry[.]com and executes whatever exploit JavaScript comes back; delivery is refused only for implausible screen sizes or non-touch devices. Sekoia recovered three n-day chains: Class A for iOS 16.7 (CVE-2025-43529 WebKit RCE plus the CVE-2024-27834 PAC bypass) stealing app cookies; Class B, the DarkSword kit for iOS 18.5 (CVE-2025-43529, CVE-2026-20700, CVE-2025-14174, CVE-2025-43510, CVE-2025-43520), harvesting messages, mail, WhatsApp and Telegram databases, Keychain, location, Health, photos and iCloud Drive; and Class C for Android Chrome 139 to 145 except 143 (CVE-2026-3910 plus the Adreno driver bug CVE-2025-27038) dropping AndroSnitch to take Chrome cookies, logins and history and saved Wi-Fi passwords. All three exfiltrate to ad.starx-net[.]com:8881/telemetry/v12 without persistence. The objective is intelligence collection, with stolen session cookies enabling access to webmail and other browser-based services. CISA added CVE-2024-27834 to its Known Exploited Vulnerabilities catalog on Nov. 4, 2026. Hunt leads, false positive expectations and indicators are detailed below; Sekoia withheld its YARA rules and some hosts (TLP:AMBER for CERTs and law enforcement), so no published rule content is reproduced.

ATT&CK chain: Resource Development → Initial Access → Execution → Privilege Escalation → Discovery → Collection → Exfiltration

Hunt Lead Grid

Delivery and Exfiltration Infrastructure Sweep

Sekoia publishes the delivery host static.flux-telemetry[.]com (registered April 2, 2026, 109.104.106[.]107, AS395092 Shock Hosting), the Plerdy-stage load balancer edge-ord.clouds-stacks[.]com (registered Aug. 26, 2026, 95.133.231[.]28, AS219399 servinga), the exfiltration host ad.starx-net[.]com (registered April 3, 2026, 195.58.140[.]105, AS395092), the additional delivery domains adsprism-stat[.]com, ads-it-assets[.]com, cdn.adv-static[.]com, wpvortex-mod[.]com and assets-int[.]com, and the reverse-proxy lookalikes america250[.]holiday (registered May 19, 2026) and theowo[.]club (registered June 18, 2026). Victims’ browsers fetch /module/5b4c8fea5cbcee273e8d830f52-temfp.js from a delivery host, POST JSON to /api/<nonce>/v1, and compromised phones send stolen data over HTTPS to port 8881 at /telemetry/v12. The detection logic is a retrospective sweep of DNS, secure web gateway, firewall and mobile-network (MDM or mobile threat defense) logs for any of the ten domains or three IPs, with priority on any connection to ad.starx-net[.]com or to TCP 8881 on 195.58.140[.]105, which indicates successful exploitation rather than a mere visit.

Use DNS resolver logs, proxy logs, firewall and NetFlow, and mobile threat defense or MDM network telemetry, since most hits will come from phones on corporate Wi-Fi or a managed VPN. Sweep back to April 2026, when the core domains were registered, and pay particular attention to Aug. 27 to Sept. 3, 2026 for organizations whose staff browse Ukrainian sites. Scope first to staff working on Ukraine, defense, diplomacy, government relations and political parties, and to anyone who attended or organized events tied to America250 or stayed near Whitehall. Block the domains and the exfiltration IP, but do not block the shared hosting ASNs wholesale. A hit on the exfiltration endpoint means the device was compromised: escalate to incident response, assume that phone’s browser and app sessions, saved Wi-Fi credentials and, for iOS 18.5, message and Keychain contents are in attacker hands, and revoke sessions and rotate credentials accordingly. Because Sekoia withheld some hosts, a clean sweep is not proof of non-exposure.

Hunt Lead Level: 1 (Junior Analyst)

ATT&CK: Initial Access → T1189 (Drive-by Compromise); Exfiltration → T1041 (Exfiltration Over C2 Channel)

Sources: “Poisoned Source: APT29 watering holes target mobile devices with n-day exploits”, Sekoia TDR, Nov. 4, 2026, https://www.sekoia.com/blog/poisoned-source-apt29-watering-holes-targets-mobile-devices-with-n-day-exploits (source article)

Fingerprinting Script Injected Into Websites You Run

On directly compromised sites the operators either edited the main page template to append a script element after page load, or appended the same code to an existing legitimate JavaScript library file (as on a Bulgarian military-related site), so the page HTML can look untouched while a bundled .js file carries the injection. In the Plerdy stage the tampered file was the tracker itself, hxxps://a.plerdy[.]com/public/js/click/main.js, which loaded the legitimate tracker plus a script from edge-ord.clouds-stacks[.]com. In every case the end target is a file named 5b4c8fea5cbcee273e8d830f52-temfp.js served from a /module/ path on an attacker domain. The detection logic is a content-integrity check across every web property and CMS you operate: search rendered pages, template files and all served JavaScript for the string temfp.js, for any of the delivery domains, and for dynamically created script elements pointing at domains not in your approved third-party list; for Plerdy customers, compare the main.js your pages received during Aug. 27 to Sept. 3, 2026 (from CDN, WAF or browser-side CSP reports) against the vendor’s clean version.

Use web server and CDN access logs, file-integrity monitoring on web roots, CMS change history, and Content-Security-Policy violation reports if you collect them. Sweep at least six months, because the core domains were live from April and Sekoia found artifacts from an earlier 2025 APT29 campaign still sitting in one victim’s files. Scope to public-facing sites likely to draw government, defense, diplomatic or political visitors, but include marketing and event microsites, which are often less watched. Allowlisting the Plerdy include itself is fine; the anchor is any extra script reference it or your templates pull in. Removing the injected line is not enough: treat a hit as a server compromise, find the original access path, rotate CMS and hosting credentials, and notify your national CERT, since your visitors may have been exploited. A strict CSP with an explicit script-src allowlist generalizes to this and most other script-injection watering holes.

Hunt Lead Level: 1 (Junior Analyst)

ATT&CK: Resource Development → T1608.004 (Stage Capabilities: Drive-by Target); Initial Access → T1195.002 (Supply Chain Compromise: Compromise Software Supply Chain)

Sources: “Poisoned Source: APT29 watering holes target mobile devices with n-day exploits”, Sekoia TDR, Nov. 4, 2026, https://www.sekoia.com/blog/poisoned-source-apt29-watering-holes-targets-mobile-devices-with-n-day-exploits (source article)

Mobile Browser Fingerprint POST, Then Script, Then Port 8881

The delivery sequence is consistent across all three chains. A mobile browser loads the roughly 2.3 MB temfp.js, then sends an HTTPS POST with Content-Type application/json, a large body of device fields, to /api/ followed by a 32-character alphanumeric token and /v1 on the same delivery host; the response is JavaScript that the page injects and runs. On iOS the exploit first sets a cookie named VDGH_TOKEN_REF as a replay guard. For Class B, further stages are fetched from hxxps://ad.starx-net[.]com/api/<nonce>/v1; for every chain, collection ends with an HTTPS POST to port 8881 at /telemetry/v12, and on Android AndroSnitch sends it via libcurl with Filename and X-Device-Id headers. The detection logic, built on proxy or TLS-inspection logs, flags a client with a mobile Safari or Android Chrome user agent that, within a few minutes, downloads a JavaScript file over 2 MB from a domain first seen in the last 90 days, POSTs JSON to a path matching /api/[A-Za-z0-9]{32}/v1 on that domain, and then opens an HTTPS session to a non-standard port such as 8881 on any host, with extra weight when the client runs iOS 16.0 to 17.4, iOS 18.5 or Chrome 139 to 145.

Use secure web gateway or TLS-inspecting proxy logs for corporate Wi-Fi and managed VPN traffic, joined to MDM inventory for OS and browser versions; where you can’t inspect TLS, fall back to SNI, destination port and newly-observed-domain feeds. Sweep 180 days. Scope to managed and BYOD phones of high-risk staff first. Expect false positives from ad-tech and anti-fraud fingerprinting, which also POSTs JSON blobs; suppress established vendors by registered domain age and reputation rather than by path, and require the port-8881 or non-standard-port follow-on for an alert. Blocking outbound 8881 at the perimeter is a reasonable hardening step but will not help a phone on a home or mobile network, so pair this lead with enforced minimum OS versions in MDM. Treat any full-sequence match as a likely compromise and escalate; the pattern generalizes to other fingerprint-gated mobile exploit kits that reuse commercial surveillance tooling.

Hunt Lead Level: 2 (Pro)

ATT&CK: Reconnaissance → T1592 (Gather Victim Host Information); Execution → T1203 (Exploitation for Client Execution)

Sources: “Poisoned Source: APT29 watering holes target mobile devices with n-day exploits”, Sekoia TDR, Nov. 4, 2026, https://www.sekoia.com/blog/poisoned-source-apt29-watering-holes-targets-mobile-devices-with-n-day-exploits (source article)

Webmail Session Reuse After a Mobile Cookie Theft

The payoff of all three chains is session material. Class A walks running iOS apps’ sandbox containers and reads every Cookies.binarycookies file it can reach; Class C copies Chrome’s Cookies, Login Data and History databases on Android; Class B takes the Keychain, account credentials and Safari data along with everything else. Sekoia notes this lets the operators reuse authenticated sessions to reach browser-based services such as webmail, and Google TAG linked APT29’s 2024 campaign to the same cookie-theft goal. The detection logic correlates identity-provider and webmail sign-in logs with the infrastructure hits from the first lead: for each user whose phone reached any listed domain or port 8881, look for subsequent use of an existing session (no interactive sign-in, no MFA event) from a new ASN, country, device ID or user agent, especially hosting or VPN ASNs, and for mailbox actions from that session such as bulk mail access, new forwarding rules or new app passwords.

Use identity-provider sign-in and token logs, webmail or Microsoft 365 / Google Workspace audit logs, and the network telemetry from the first lead. Sweep from April 2026 forward. Scope to users with a positive infrastructure hit, then widen to all high-risk users, because Sekoia withheld some delivery and exfiltration hosts and a clean network sweep does not rule out exposure. Expect noise from travel and VPN use; baseline each user’s normal ASNs and devices, and raise confidence when the session reuse follows a hit within days. Resetting the password alone is the wrong response, since a stolen cookie survives it: revoke all sessions and refresh tokens, re-register MFA from a known-clean device, and review mailbox rules. Token binding or device-bound session credentials, where your provider supports them, defeat this class of theft generally.

Hunt Lead Level: 3 (Elite)

ATT&CK: Credential Access → T1539 (Steal Web Session Cookie); Lateral Movement / Defense Evasion → T1550.004 (Use Alternate Authentication Material: Web Session Cookie)

Sources: “Poisoned Source: APT29 watering holes target mobile devices with n-day exploits”, Sekoia TDR, Nov. 4, 2026, https://www.sekoia.com/blog/poisoned-source-apt29-watering-holes-targets-mobile-devices-with-n-day-exploits (source article); “State-backed attackers and commercial surveillance vendors repeatedly use the same exploits”, Google TAG, Aug. 2024, https://blog.google/threat-analysis-group/state-backed-attackers-and-commercial-surveillance-vendors-repeatedly-use-the-same-exploits/ (additional source, APT29 2024 cookie-theft watering holes)

Hash Appendix

Exploit chains and AndroSnitch

SHA-256s come from the source article’s IOC table and chain sections; Sekoia published no MD5s or SHA-1s, and OTX AlienVault and VirusTotal were not checked. Most of these are JavaScript exploit stages served to browsers, so they are best matched in proxy content inspection or web caches rather than on endpoints.

MD5s
(not available)  # Class-A-Stage1 -> iOS 16.7 chain stage 1 (JS)
(not available)  # Class-A-Stage2 -> iOS 16.7 exploit + cookie stealer (JS, 101K)
(not available)  # Class-B-Stage1 -> DarkSword iOS 18.5 chain stage 1
(not available)  # Class-B-Stage2 -> DarkSword iOS 18.5 chain stage 2
(not available)  # Class-B-Stage3 -> DarkSword iOS 18.5 chain stage 3
(not available)  # Class-B component -> listed in Class B section
(not available)  # Class-B component 2 -> listed in Class B section
(not available)  # Class-C-Stage1-JS -> Android Chrome RCE (JS)
(not available)  # Class-C-Stage2-JS -> Android Chrome stage 2 (JS)
(not available)  # Class-C-Stage2-CVE-2025-27038 -> Adreno sandbox escape shellcode
(not available)  # Class-C component -> listed in Class C section
(not available)  # Class-C component 2 -> listed in Class C section
(not available)  # AndroSnitch -> libexploit.so cookie and Wi-Fi stealer

SHA1s
(not available)  # Class-A-Stage1 -> iOS 16.7 chain stage 1 (JS)
(not available)  # Class-A-Stage2 -> iOS 16.7 exploit + cookie stealer (JS, 101K)
(not available)  # Class-B-Stage1 -> DarkSword iOS 18.5 chain stage 1
(not available)  # Class-B-Stage2 -> DarkSword iOS 18.5 chain stage 2
(not available)  # Class-B-Stage3 -> DarkSword iOS 18.5 chain stage 3
(not available)  # Class-B component -> listed in Class B section
(not available)  # Class-B component 2 -> listed in Class B section
(not available)  # Class-C-Stage1-JS -> Android Chrome RCE (JS)
(not available)  # Class-C-Stage2-JS -> Android Chrome stage 2 (JS)
(not available)  # Class-C-Stage2-CVE-2025-27038 -> Adreno sandbox escape shellcode
(not available)  # Class-C component -> listed in Class C section
(not available)  # Class-C component 2 -> listed in Class C section
(not available)  # AndroSnitch -> libexploit.so cookie and Wi-Fi stealer

SHA256s
a7d2493df00565c21587b0cad2a9fe7ca1e5590acf796da6e499be0ffde44cc3  # Class-A-Stage1 -> iOS 16.7 chain stage 1 (JS)
bee3e014e3df87ddce0250b0985b87f6868a427a7b650a74b7ffedb9d57f3088  # Class-A-Stage2 -> iOS 16.7 exploit + cookie stealer (JS, 101K)
c170fda024183645c0aa681149304e50506509c3498bb6b9a5f5ced6aa73e5fa  # Class-B-Stage1 -> DarkSword iOS 18.5 chain stage 1
2ffb35e3f9e55286a930fb887e73764a913166648135fe0ca7551736d97d7bfa  # Class-B-Stage2 -> DarkSword iOS 18.5 chain stage 2
69b6cb327a4d5da99399718f6a66f84de69f89425b0a31f2dcee0682f811596f  # Class-B-Stage3 -> DarkSword iOS 18.5 chain stage 3
35c0cd19a7334b544c193e392bcd9a8f1d1f43cf6b61be5bf1d9e35537aff2ef  # Class-B component -> listed in Class B section
621112712ec515e8791129c62feda8fff6654a0116882401609503cacc08054a  # Class-B component 2 -> listed in Class B section
29d283ebd08d0cd3b2e6f4a67718d3d6e7a6be01d0613d716bce218dba57a928  # Class-C-Stage1-JS -> Android Chrome RCE (JS)
06c17b31d36838f3d29044784aa047d5c2d9174d3356c1211cf25f9df677445f  # Class-C-Stage2-JS -> Android Chrome stage 2 (JS)
183d62d682aea8018491c8559544e8d6a9ab0e1abd05ecbb6c97daa4f438d2b8  # Class-C-Stage2-CVE-2025-27038 -> Adreno sandbox escape shellcode
ae3241d96cc2d99538c7aff60f382cc8dac13859bcbea3ee84992d24d22a8108  # Class-C component -> listed in Class C section
41e6fd33a30d36dabff9ea408d9766a6583edcc107968f6dc1499f2586381967  # Class-C component 2 -> listed in Class C section
387a7fb768db1350a9788d9704e7a72abe07152734e0ff026af72b417e36268c  # AndroSnitch -> libexploit.so cookie and Wi-Fi stealer

References Appendix

• “Poisoned Source: APT29 watering holes target mobile devices with n-day exploits”, Sekoia TDR (Amaury Garçon, Félix Aime, Robin Kwiatkowski), Nov. 4, 2026, https://www.sekoia.com/blog/poisoned-source-apt29-watering-holes-targets-mobile-devices-with-n-day-exploits (source article; vectors, chains, infrastructure, hashes, attribution)
• “State-backed attackers and commercial surveillance vendors repeatedly use the same exploits”, Google Threat Analysis Group, Aug. 2024, https://blog.google/threat-analysis-group/state-backed-attackers-and-commercial-surveillance-vendors-repeatedly-use-the-same-exploits/ (APT29’s 2024 cookie-theft watering holes, cited by the source)
• CISA Known Exploited Vulnerabilities Catalog, CVE-2024-27834 (added Nov. 4, 2026, due Nov. 18, 2026), https://www.cisa.gov/known-exploited-vulnerabilities-catalog
• MITRE ATT&CK Enterprise technique pages linked above, MITRE, https://attack.mitre.org/