State-Sponsored Hackers Target Mobile Devices Across Europe and North America
Research has revealed that Russian state-affiliated cyber operatives have orchestrated a campaign aimed at infiltrating the mobile devices of users based in Ukraine, the United States, and various European nations, with the ultimate goal of pilfering sensitive information from both iPhones and Android smartphones.
Attributing the campaign to APT29—prolific espionage agents better known as Cozy Bear or Midnight Blizzard—French cybersecurity firm Sekoia indicates this group is widely suspected of operating on behalf of Russia’s foreign intelligence agency (SVR).
In their findings, researchers disclosed that the hackers deployed malicious code on legitimate websites, fabricated replicas of popular platforms, and compromised a Ukrainian web analytics service as a means of ensnaring potential victims, as detailed in a report released last Wednesday.
The intrusion allowed attackers to surreptitiously extract passwords, messages, emails, browsing history, and a plethora of other private data from susceptible devices, in some incidents achieving this covertly—without requiring victims to click on dubious links or download harmful files.
The investigation was initiated upon the discovery of malicious code embedded within the website of a yet-unnamed Ukrainian gas production entity.
Subsequent evaluations unveiled a broader pattern of breaches affecting other institutions, notably a prominent U.S. chemical industry trade association and a far-right political organization in Europe.
Among their more audacious tactics, the hackers constructed counterfeit versions of two notable websites: America250, a project celebrating the 250th anniversary of U.S. independence, and Raffles London at The OWO, a luxury hotel situated near key British government establishments.
These fraudulent sites displayed content masquerading as that of their legitimate counterparts while simultaneously executing malicious code designed to detect visitors utilizing vulnerable devices.
Speculation among researchers suggests that the counterfeit America250 site may have been utilized to entice victims with invitations to anniversary festivities, while the hotel mimic could have been aimed at targeting diplomats and other influential figures.
It is worth mentioning that Ukrainian President Volodymyr Zelensky is believed to have stayed at the Raffles during an October visit, although no conclusive evidence indicates he was a target.
In what appears to be one of the campaign’s most expansive initiatives, the attackers successfully compromised Plerdy, a Ukrainian web analytics service employed by thousands of websites, predominantly within Ukraine.
Between the latter part of August and early September, the intruders embedded malicious code into a tracking script circulated via the service, thereby possibly exposing visitors to numerous sites—including those linked to the Ukrainian military and manufacturers of military drone technology—throughout this period.
This compromised script enabled the attackers to ascertain the devices and software versions of visitors prior to exploiting identified security vulnerabilities.
Sekoia has reported uncertainty regarding whether the hackers aimed to single out specific individuals or were engaging in a broader information-gathering strategy across numerous vulnerable devices before determining their most valuable targets.
Data Theft from Smartphones
Employing distinct attack methodologies depending on the device and operating system, the hackers displayed particular sophistication.
For older iPhones running iOS 16, the assaults focused on pilfering browser and application cookies, potentially granting the hackers access to users’ online accounts.
Conversely, a more intricate attack targeted susceptible iPhones operating on iOS 18.5, enabling the extraction of messages, emails, passwords, contacts, photos, location history, and data from messaging applications such as WhatsApp and Telegram.
This latter attack utilized a toolkit identified as DarkSword, a suspected commercially available surveillance mechanism capable of harvesting extensive information from iPhone devices.
DarkSword has been previously reported to have been utilized by various threat actors in operations aimed at users in regions including Saudi Arabia, Turkey, and Malaysia.
On Android devices, the hackers capitalized on vulnerabilities found in earlier iterations of Google’s Chrome browser to commandeer browsing data, cookies, and stored Wi-Fi passwords.
In contrast to certain spyware initiatives, these attacks were engineered to extract data without the necessity of establishing prolonged access to compromised devices.
All three attack vectors leveraged previously disclosed vulnerabilities that Apple and Google had patched prior to the onset of this campaign.
Researchers noted that the attacks did not exploit any previously unknown software flaws, referred to as zero-days, and would consequently be ineffective against fully updated devices.
While Sekoia did not ascertain the precise number of smartphones that fell victim to the campaign or the extent of the information compromised, it has stated that it is collaborating with computer emergency response teams in the nations affected to identify potential victims and explore viable strategies for disrupting the hackers’ operational infrastructure.
Source link: Therecord.media.
