iOS and Android Users Targeted in Malware Campaign Linked to Russia's Foreign Intelligence Service

Hackers linked to Russia's Foreign Intelligence Service have exploited previously patched iOS and Android flaws in an attempt to hack visitors of multiple websites. According to researchers, these attackers targeted a range of sites, many related to Russia's ongoing conflict with Ukraine.

The attacks began when iPhone or Android users visited one of potentially hundreds of compromised sites, allowing the hackers to inject JavaScript into the traffic. This malicious code then profiled the device and tailored payloads to the type of platform visiting, aiming to steal sensitive information. The final goal was to obtain browser cookies, Wi-Fi passwords, and in some cases, full mobile device data.

One of the impersonated websites was america250.org, a site belonging to a non-partisan group of lawmakers, business executives, and at least one former member of the Trump administration. To carry out the attack, hackers registered the domain name america250[.]holiday as a reverse proxy to america250.org. This setup allowed them to deliver content from the real website that included malicious JavaScript.

The attackers used this tactic to inject malware into the traffic of unsuspecting visitors, potentially exposing their sensitive information to the hackers. The full scope and impact of these attacks are still being assessed by researchers, who have linked the attackers to Russia's Foreign Intelligence Service with moderate to high confidence.

Researchers at security firm Sekoia have uncovered new details about the hacking campaign that exploited iOS and Android vulnerabilities. The attackers may have deliberately targeted a website associated with a high-profile national celebration in Ukraine, using it as a pretext for spear-phishing campaigns.

The hackers also impersonated another website, Raffles of London OWO, which is located near sensitive government institutions in the UK, including the Ministry of Defence and 10 Downing Street. This was done to target diplomatic delegations and high-profile guests through targeted attacks. According to open source reporting, Ukrainian President Volodymyr Zelenskyy stayed at this hotel during a visit on October 14.

The attackers used multiple vectors to deliver their attacks, including compromised websites such as a top Ukrainian gas production company's website. They also exploited a Ukrainian web analytics service that serves thousands of websites. This suggests a sophisticated and wide-ranging campaign.

Sekoia's attribution of the hacking group to the Kremlin is based on the targets' profiles and similarities to previous attacks attributed to APT29, one of the names used to track this suspected Russian group. The full scope and impact of these attacks are still being assessed by researchers.

The hackers relied on multiple infection vectors to compromise mobile devices, including direct JavaScript injection into legitimate websites, proxy domains like america250[.]holiday, and a supply-chain attack targeting a Ukrainian web analytics service.

In each of these cases, the injected JavaScript was identical, and its primary function was to gather information about the visitor's browser and device. This intelligence was then used to deliver one of three zero-click exploit chains that could compromise the target's mobile operating system without requiring any user interaction.

The exploited vulnerabilities were "n-days" flaws, meaning they had already been patched by their respective manufacturers, and only affected outdated versions of iOS or Android.