APT29 (Midnight Blizzard) watering holes target iOS and Android devices with n-day exploit chains (DarkSword, AndroSnitch)

Key facts for APT29 DarkSword watering holes

Detection coverage for APT29 DarkSword watering holes

As of 2026-11-04, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-5214 across Splunk SPL, Microsoft KQL and Sigma, covering 36 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: APT29 DarkSword / AndroSnitch Payload and Chain Component File Artifacts

Detects file artifacts of the APT29 mobile exploit chains: the 13 published SHA-256 hashes of Class A/B iOS chain components and the DarkSword-style harvester, the Class C Android Chrome exploits, shellcode and AndroSnitch (libexploit.so, a Chrome Cookies/Login Data/History and WifiConfigStore.xml stealer), as well as libexploit.so and the UltimateFingerprinter file 5b4c8fea5cbcee273e8d830f52-temfp.js by name. Covers triage artifacts, sandbox or forensic extractions and endpoints that cached or downloaded chain components.

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1203, T1068, T1555.003, T1555.001, T1539, T1005
• Data sources: sysmon (index=sysmon, EventCode 1/7/11/15), DeviceFileEvents (Microsoft Defender for Endpoint), Linux file_event telemetry (Sigma category file_event, product linux)
• Severity: critical
• Confidence: high

Splunk SPL

index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" earliest=-30d (Hashes IN ("*bee3e014e3df87ddce0250b0985b87f6868a427a7b650a74b7ffedb9d57f3088*","*a7d2493df00565c21587b0cad2a9fe7ca1e5590acf796da6e499be0ffde44cc3*","*35c0cd19a7334b544c193e392bcd9a8f1d1f43cf6b61be5bf1d9e35537aff2ef*","*621112712ec515e8791129c62feda8fff6654a0116882401609503cacc08054a*","*69b6cb327a4d5da99399718f6a66f84de69f89425b0a31f2dcee0682f811596f*","*c170fda024183645c0aa681149304e50506509c3498bb6b9a5f5ced6aa73e5fa*","*ae3241d96cc2d99538c7aff60f382cc8dac13859bcbea3ee84992d24d22a8108*","*41e6fd33a30d36dabff9ea408d9766a6583edcc107968f6dc1499f2586381967*","*183d62d682aea8018491c8559544e8d6a9ab0e1abd05ecbb6c97daa4f438d2b8*","*387a7fb768db1350a9788d9704e7a72abe07152734e0ff026af72b417e36268c*","*29d283ebd08d0cd3b2e6f4a67718d3d6e7a6be01d0613d716bce218dba57a928*","*06c17b31d36838f3d29044784aa047d5c2d9174d3356c1211cf25f9df677445f*","*2ffb35e3f9e55286a930fb887e73764a913166648135fe0ca7551736d97d7bfa*") OR TargetFilename IN ("*libexploit.so","*5b4c8fea5cbcee273e8d830f52-temfp.js") OR Image="*libexploit.so") | fillnull value="n/a" User Image TargetFilename Hashes | stats earliest(_time) as first_seen latest(_time) as last_seen count values(Hashes) as hashes by Computer, User, Image, TargetFilename, EventCode | eval first_seen=strftime(first_seen,"%Y-%m-%d %H:%M:%S"), last_seen=strftime(last_seen,"%Y-%m-%d %H:%M:%S") | table first_seen last_seen Computer User EventCode Image TargetFilename hashes count

Microsoft KQL

let IocSha256 = dynamic(['bee3e014e3df87ddce0250b0985b87f6868a427a7b650a74b7ffedb9d57f3088','a7d2493df00565c21587b0cad2a9fe7ca1e5590acf796da6e499be0ffde44cc3','35c0cd19a7334b544c193e392bcd9a8f1d1f43cf6b61be5bf1d9e35537aff2ef','621112712ec515e8791129c62feda8fff6654a0116882401609503cacc08054a','69b6cb327a4d5da99399718f6a66f84de69f89425b0a31f2dcee0682f811596f','c170fda024183645c0aa681149304e50506509c3498bb6b9a5f5ced6aa73e5fa','ae3241d96cc2d99538c7aff60f382cc8dac13859bcbea3ee84992d24d22a8108','41e6fd33a30d36dabff9ea408d9766a6583edcc107968f6dc1499f2586381967','183d62d682aea8018491c8559544e8d6a9ab0e1abd05ecbb6c97daa4f438d2b8','387a7fb768db1350a9788d9704e7a72abe07152734e0ff026af72b417e36268c','29d283ebd08d0cd3b2e6f4a67718d3d6e7a6be01d0613d716bce218dba57a928','06c17b31d36838f3d29044784aa047d5c2d9174d3356c1211cf25f9df677445f','2ffb35e3f9e55286a930fb887e73764a913166648135fe0ca7551736d97d7bfa']);
DeviceFileEvents
| where Timestamp > ago(30d)
| where SHA256 in~ (IocSha256) or FileName in~ ('libexploit.so', '5b4c8fea5cbcee273e8d830f52-temfp.js')
| project Timestamp, DeviceName, ActionType, FolderPath, FileName, SHA256, InitiatingProcessFileName, InitiatingProcessAccountName
| order by Timestamp desc

Sigma

title: APT29 AndroSnitch libexploit.so and UltimateFingerprinter File Artifacts
id: e2b9a6d4-0f73-4c15-b8e6-9a41c7d5f204
status: experimental
description: Detects creation of the AndroSnitch payload library libexploit.so (Chrome Cookies, Login Data, History and WifiConfigStore.xml stealer) or the UltimateFingerprinter script 5b4c8fea5cbcee273e8d830f52-temfp.js on Linux-based hosts, emulators or forensic images (TL-2026-5214). Hash-based coverage of the 13 chain component SHA-256 values is provided in the SPL and KQL forms.
references:
  - https://www.sekoia.com/blog/poisoned-source-apt29-watering-holes-targets-mobile-devices-with-n-day-exploits
author: AII-Detector — ThreadLinqs Intelligence
date: 2026/11/04
tags:
  - attack.execution
  - attack.t1203
  - attack.privilege-escalation
  - attack.t1068
  - attack.credential-access
  - attack.t1555.003
  - attack.t1539
  - attack.collection
  - attack.t1005
  - cve.2026.3910
  - cve.2025.27038
logsource:
  category: file_event
  product: linux
detection:
  selection:
    TargetFilename|endswith:
      - '/libexploit.so'
      - '/5b4c8fea5cbcee273e8d830f52-temfp.js'
  condition: selection
falsepositives:
  - Unrelated software that happens to ship a library named libexploit.so (for example exploit-development or test frameworks)
  - Analysts storing malware samples on monitored hosts
level: high

Known false positives:

• Analysts or sandboxes storing the published malware samples on monitored endpoints
• Unrelated software or test frameworks shipping a library named libexploit.so

Tuning notes: Native iOS and Android devices rarely forward file telemetry, so this rule mainly fires on analyst workstations, sandboxes, emulators, Chromebook/Linux endpoints, mobile forensic extractions and EDR agents that scan downloaded files. Keep filename matching but prefer hash matches for fidelity; refresh the hash list from the Sekoia IOC set. Exclude your malware-analysis lab hosts after confirming ownership. Complements MDM hash/threat alerts for the AndroSnitch payload (387a7fb7...).

• 🔒 APT29 Plerdy Supply-Chain Compromise - Redirect to Watering-Hole Delivery Domains · unlock with TL Creds
• 🔒 APT29 Exploit Chain Progression - Multiple Staged Endpoints Fetched by One Client · unlock with TL Creds
• 🔒 APT29 Campaign Infrastructure - Connections to Known IPs and Non-Standard Port 8881 Egress · unlock with TL Creds
• 🔒 APT29 Watering Hole - Look-Alike Reverse-Proxy and Delivery Domains · unlock with TL Creds
• 🔒 APT29 UltimateFingerprinter Script and VDGH_TOKEN_REF Replay-Guard Cookie · unlock with TL Creds
• 🔒 APT29 Watering Hole Campaign - DNS Resolution of Delivery, Redirect and Exfiltration Domains · unlock with TL Creds
• 🔒 APT29 Watering Hole - Nonce-Based Exploit Stage Retrieval from [indicator] · unlock with TL Creds
• 🔒 APT29 Mobile Data Exfiltration - HTTPS POST to [indicator]:8881/telemetry/v12 · unlock with TL Creds

Indicators of compromise for APT29 DarkSword watering holes

As of 2026-11-04, Threadlinqs Intelligence tracks 36 indicators of compromise for TL-2026-5214.

Sample indicators (3 of 36)

• IP address: 109.104.106[.]107
• Domain: static[.]flux-telemetry[.]com
• URL: hxxps://a[.]plerdy[.]com/public/js/click/main.js

Defanged, TLP:CLEAR. Full set of 36 indicators: unlock with TL Creds.

How APT29 DarkSword watering holes works

Sekoia TDR describes a three-stage watering-hole model. First, JavaScript is injected into legitimate websites, served from look-alike domains acting as reverse proxies (america250[.]holiday proxying america250.org, theowo[.]club proxying raffles.london), or delivered through a compromised third-party script. Second, a fingerprinting script dubbed UltimateFingerprinter (file name 5b4c8fea5cbcee273e8d830f52-temfp.js, about 2.3 MB, 98% AngularJS dead code around an embedded minified payload) runs 61 collectors that aggregate 394 JSON fields (canvas, audio, WebGL, fonts, WebRTC, media devices, battery, sensors, USB/NFC/Bluetooth, Apple-specific features). It refuses delivery when the screen size is not phone-like (e.g. 99999) or maxTouchPoints is 0, and uses a short-lived VDGH_TOKEN_REF replay-guard cookie (about one minute despite a days=1 misconfiguration). Third, platform-specific n-day exploit chains are fetched from nonce-based endpoints such as /api/[NONCE]/v1, /v2 and /v3 on static.flux-telemetry[.]com.

Three exploit classes were observed. Class A (iOS 16.7) chains CVE-2025-43529 (WebContent RCE) with CVE-2024-27834 (PAC bypass) and steals browser cookies; CVE-2024-27808 and CVE-2024-27833 are present as dead code. Class B (iOS 18.5) is nearly identical to the publicly disclosed DarkSword kit: /v1 uses CVE-2025-43529 plus CVE-2026-20700 (PAC bypass), /v2 sandbox escape uses CVE-2025-14174 and CVE-2025-43510, and /v3 kernel read/write uses CVE-2025-43520, with CVE-2025-31277 and CVE-2025-24201 left as unused alternates. The post-exploitation harvester collects sms.db and iMessage, mail indexes, voicemail, WhatsApp and Telegram databases, Keychain credentials, Wi-Fi PSKs, contacts, call history, Safari history and cookies, Health data, the photo library and iCloud Drive. Class C (Android Chrome 139-145) uses CVE-2026-3910 (Chrome renderer RCE, a V8 Maglev type confusion that Google TAG confirmed as exploited in the wild before the Chrome 146.0.7680.75 fix and that CISA lists in KEV) followed by CVE-2025-27038 (Adreno GPU driver sandbox escape), then drops AndroSnitch (internal name libexploit.so). AndroSnitch has 16 data-collection functions, was built with Clang/LLD 14.0.7, uses libcurl with a hardcoded device token, steals Chrome Cookies, Login Data, History and WifiConfigStore.xml, and stops on the Samsung Galaxy S25 Ultra (SM-S938B).

Stolen data is sent by HTTPS POST to ad.starx-net[.]com:8881/telemetry/v12 with Filename and X-Device-Id headers. The exploits install no persistence and no RAT; victims have to be re-exposed to the watering hole. In the Plerdy supply-chain compromise, the Ukrainian SEO tracker file https://a.plerdy[.]com/public/js/click/main.js was altered between Aug 27 and Sep 3, 2026, affecting thousands of mostly Ukrainian sites. edge-ord.clouds-stacks[.]com acted as a load balancer to ads-it-assets[.]com, cdn.adv-static[.]com, wpvortex-mod[.]com and assets-int[.]com. Victim sites include Ukrainian military recruitment and defense-sector sites (ballistic and UAV manufacturers), a Ukrainian gas production company, a US chemical industry trade association, a Czech far-right political party site, a Bulgarian military-related site, america250.org, Raffles London (close to UK government institutions) and an Australian medical clinic.

Sekoia attributes the activity to APT29 with moderate to high confidence, citing the overlap with the 2024 APT29 watering holes against Mongolian government sites that Google TAG reported (re-use of exploits matching NSO Group and Intellexa work), multi-hoster infrastructure (Shock Hosting AS395092, servinga AS219399, EDIS AS9009/AS57169), European and Ukrainian victimology, and leftover artifacts from a 2025 APT29 campaign on one compromised site. Sekoia also notes that the iOS version filter (16.7 only) does not match the chain's capability (16.0-17.4), which suggests third-party kit reuse. Separately, public reporting on DarkSword (in use since at least November 2025) notes that several actors have used it, including the Russian state-linked cluster UNC6353 against Ukraine. The source states no CVSS score for the campaign; severity is analyst-assigned.

MITRE ATT&CK techniques by tactic:

Collection

T1005 Data from Local System

Exfiltration

T1041 Exfiltration Over C2 Channel

Execution

T1059.007 JavaScript; T1203 Exploitation for Client Execution

Privilege Escalation

T1068 Exploitation for Privilege Escalation

Command and Control

T1071.001 Web Protocols; T1571 Non-Standard Port

Discovery

T1082 System Information Discovery

Initial Access

T1189 Drive-by Compromise; T1195.002 Compromise Software Supply Chain

Defense Evasion

T1480 Execution Guardrails; T1497 Virtualization/Sandbox Evasion

Credential Access

T1539 Steal Web Session Cookie; T1555.001 Keychain; T1555.003 Credentials from Web Browsers; T1557 Adversary-in-the-Middle

Resource Development

T1583.001 Domains; T1588.005 Exploits; T1608.004 Drive-by Target

Reconnaissance

T1592 Gather Victim Host Information

Remediation for APT29 DarkSword watering holes

Patches

• Update iOS and iPadOS to the latest release; the Apple CVEs in the chains are patched
• Update Chrome to 146.0.7680.75 or later (CVE-2026-3910) and apply current Android security patches covering the Qualcomm Adreno CVE-2025-27038

Immediate actions

• Block the listed domains, IPs and the :8881 exfiltration endpoint at DNS, proxy and firewall
• Search web proxy and DNS logs for connections to static.flux-telemetry.com, ad.starx-net.com, edge-ord.clouds-stacks.com and the Plerdy redirect domains
• Hunt web content and templates for the UltimateFingerprinter file 5b4c8fea5cbcee273e8d830f52-temfp.js and for unexpected changes to third-party analytics scripts such as a.plerdy.com main.js
• Treat sessions, cookies, Wi-Fi PSKs and credentials on devices that visited affected sites as compromised and rotate them

Workarounds

• Restrict mobile browsing to unmanaged-risk sites for high-risk users until devices are patched
• Block port 8881 egress to untrusted destinations

Longer-term hardening

• Inventory and monitor third-party JavaScript on web properties (Subresource Integrity, CSP, change monitoring)
• Enroll high-risk users in Apple Lockdown Mode and enforce MDM patch compliance on mobile fleets
• Review website backend logs for unauthorized JavaScript modification

Affected and fixed versions

• Apple — iOS / iPadOS (WebKit, kernel)
  Vulnerable versions: 16.0-17.4; 16.7; 18.5
  Fixed in: latest iOS release
• Google — Chrome for Android
  Vulnerable versions: 139-145 (excluding 143)
  Fixed in: 146.0.7680.75 and later
• Qualcomm — Adreno GPU driver (Android)
  Vulnerable versions: unpatched Android devices (CVE-2025-27038)
  Fixed in: current Android security patch level
• Plerdy — Plerdy SEO Tracker (a.plerdy.com main.js)
  Vulnerable versions: script as served Aug 27 - Sep 3, 2026
  Fixed in: restored script

Timeline of APT29 DarkSword watering holes

Last updated 2026-11-04 · 2 updates · revalidated 2× · latest source

• 2023-11-01 Start of the APT29 watering-hole exploit campaigns against Mongolian government sites later reported by Google TAG (Nov 2023 - Jul 2024); Sekoia cites technical overlap with this framework
• 2024-08-29 Google TAG publicly reports the Mongolia watering holes and their similarity to NSO Group and Intellexa exploits, assessed with moderate confidence as APT29
• 2025-11-01 locked-ioc-36 iOS exploit kit in use by multiple actors since at least November 2025 (per public reporting)
• 2026-03-13 CISA adds Chrome V8 CVE-2026-3910 to the Known Exploited Vulnerabilities catalog.
• 2026-03-18 locked-ioc-36 is publicly reported; it abuses six iOS flaws and has been used against targets including Ukraine
• 2026-03-20 CISA adds Apple CVE-2025-43510 and CVE-2025-43520 to the KEV catalog.
• 2026-04-02 locked-ioc-19 registered
• 2026-04-03 locked-ioc-25 (exfiltration, port 8881) created, hosted on locked-ioc-28 (AS395092, Shock Hosting).
• 2026-05-19 locked-ioc-22 created as a reverse proxy for america250.org
• 2026-06-18 locked-ioc-34 created as a reverse proxy for raffles.london
• 2026-08-26 locked-ioc-18 registered
• 2026-08-27 Plerdy analytics script a.plerdy[.]com/public/js/click/main.js begins serving malicious code, affecting thousands of mostly Ukrainian websites
• 2026-09-03 End of the one-week Plerdy supply-chain compromise window
• 2026-09-15 locked-ioc-36 exploit kit sample uploaded to VirusTotal (September 2026; exact day not stated, mid-month used as placeholder)
• 2026-10-14 Ukrainian President Zelensky stays at Raffles London at The OWO, the venue spoofed by locked-ioc-34 (context reported by Sekoia; not shown to be a confirmed targeting objective).
• 2026-10-15 Sekoia TDR detects the watering-hole campaign (mid-October 2026; exact day not stated) and coordinates with CERT-UA, Google TAG and affected-country CERTs
• 2026-11-04 Sekoia publishes 'Poisoned Source' with attribution to APT29 at moderate to high confidence

Update history

• 2026-11-04 — APT29 (Midnight Blizzard) Watering-Hole Campaign Targets iOS and Android Users with N-Day Exploit Chains (CVE-2025-43529, CVE-2026-20700, CVE-2026-3910 and others): What changed No severity, exploitability, status or attribution change; the existing HIGH / ACTIVE / MEDIUM values already match the newer report. New indicators (2) Indicator values are withheld at this access level. New timeline 2026-10-1
• 2026-11-04 — APT29 'Poisoned Source' Watering-Hole Campaign Hijacks Plerdy SEO Tracker Script to Deliver locked-ioc-36 (iOS) and locked-ioc-35 (Android) N-Day Exploit Chains (CVE-2025-43529, CVE-2026-20700, CVE-2026-3910, CVE-2025-27038): What changed No field escalation: severity HIGH, exploitability ACTIVE, status ACTIVE and attribution confidence MEDIUM are unchanged. Record enriched additively. New indicators (5) Indicator values are withheld at this access level. New CV

Sources cited for APT29 DarkSword watering holes

• CVE-2026-3910 Known Exploited Vulnerability detail (CVEfeed) cvefeed.io · Advisory
• Poisoned Source: APT29 watering holes target mobile devices with n-day exploits (Sekoia) sekoia.com · Blog · 2026-11-04
• DarkSword exploit kit steals iPhone data (The Register) The Register · News · 2026-03-18
• DarkSword iOS exploit kit uses 6 flaws (The Hacker News) The Hacker News · News
• DarkSword iOS exploit kit used by state-sponsored hackers and spyware vendors (SecurityWeek) SecurityWeek · News
• CISA adds Google Chrome flaws to its Known Exploited Vulnerabilities catalog (Security Affairs) securityaffairs.com · News
• APT29, NSO Group and Intellexa mobile exploits - Mongolia watering holes (Security Affairs) securityaffairs.com · News · 2024-08-29
• Mongolian government sites hit by APT29 watering holes using NSO Group and Intellexa exploits (The Record) The Record · News · 2024-08-29
• Commercial spyware exploits used by Russia against Mongolia (The Register) The Register · News · 2024-08-29

More in apt

• Gorbag: Russia-aligned espionage group targets Ukrainian war crimes investigations and military aid routes (BeautyStealer, Prime ReverseShell, CVE-2025-8088)
• ARTEX Agentic AI Penetration-Testing Framework Abused by China-Aligned Actors Storm-0940 and VAPOR PANDA to Automate Enterprise and Cloud Intrusions
• Kimsuky (APT43) Dot-Padded LNK Spear-Phishing Tradecraft: Detection and Exploitation Analysis
• TraderTraitor (North Korea) months-long campaign leads to $6.34B Binance cryptocurrency theft
• AI agent frameworks ARTEX (Vapor Panda, Storm-0940) and CyberStrikeAI scale China-linked intrusion campaigns