Security researchers have identified a campaign targeting visitors to multiple websites, including those celebrating the 250th anniversary of American independence and a luxury hotel near UK government buildings. The attackers, assessed with moderate to high confidence as part of Russia’s Foreign Intelligence Service, exploited previously patched vulnerabilities in iOS and Android operating systems.
Impersonating High-Profile Websites
The intrusion set used several methods to deliver malicious code. One approach involved registering lookalike domains to act as reverse proxies for legitimate sites. For example, the group registered america250.holiday to impersonate america250.org, a site associated with a non-partisan group of lawmakers and business executives. The imposter site delivered content from the real domain but injected malicious JavaScript into the traffic.
Another target was theowo.club, which proxied the website for Raffles of London OWO. This luxury hotel is located near sensitive UK government institutions, including the Ministry of Defence and 10 Downing Street. Open source reporting indicates that Ukrainian President Volodymyr Zelenskyy stayed at the hotel during a visit on October 14. Researchers believe the attackers chose this location to target diplomatic delegations and high-profile guests.
Sekoia, the security firm that analyzed the campaign, stated that the selection of these websites likely leveraged high-profile national celebrations as a pretext for spear-phishing campaigns. The group also compromised a top Ukrainian gas production company and a Ukrainian web analytics service that serves thousands of websites to distribute their attacks.
Technical Execution and Exploits
The attacks relied on three main infection vectors: direct JavaScript injection into traffic from legitimate websites, proxy domains, and supply-chain compromises. In each case, the injected JavaScript was identical. The code first profiled the visitor’s browser and device type. Based on this information, the attackers delivered one of three zero-click exploit chains.
One of the identified chains was DarkSword, an iOS exploit kit previously linked to PARS Defense, a commercial surveillance vendor in Turkey, and at least two other threat actors. Sekoia noted that the more recent campaign used two other exploit chains that were not named. All of the vulnerabilities exploited in this campaign were n-days, meaning they had already been patched by Apple and Google. The attacks only succeeded on outdated versions of iOS or Android that had not received the latest security updates.
The final payloads were tailored to the specific platform of the victim. The malware attempted to steal browser cookies and, in some cases, Wi-Fi passwords and full mobile device data. The attribution to the Kremlin is based on the profiles of the targets and similarities to a previous attack attributed to APT29, one of the names used to track the suspected Russian group.
Source: Ars Technica
