# APT29 (Midnight Blizzard) watering holes target iOS and Android devices with n-day exploit chains (DarkSword, AndroSnitch)

> Sekoia reports APT29 watering-hole campaigns, detected mid-October 2026, that deliver multi-stage n-day exploit chains against iOS and Android through compromised and fake websites, including a supply-chain compromise of the Plerdy analytics service (Aug 27 - Sep 3, 2026). Activity is assessed with moderate to high confidence as linked to Russia's SVR and targets Ukraine, the US, Czech Republic, Bulgaria and Europe more broadly.

- **Published:** 2026-11-04T06:12:15Z
- **Last reviewed:** 2026-11-04T20:28:40.703Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-5214
- **ID:** TL-2026-5214
- **Severity:** HIGH
- **Category:** APT
- **Status:** ACTIVE
- **Actor:** APT29 (Russia)
- **Detections:** 9 (1 shown free below) · **IOCs:** 36 (3 shown free below)
- **CVEs:** CVE-2025-43529, CVE-2024-27834, CVE-2026-20700, CVE-2025-14174, CVE-2025-43510, CVE-2025-43520, CVE-2026-3910, CVE-2025-27038

## Description

Sekoia TDR describes a three-stage watering-hole model. First, JavaScript is injected into legitimate websites, served from look-alike domains acting as reverse proxies (america250[.]holiday proxying america250.org, theowo[.]club proxying raffles.london), or delivered through a compromised third-party script. Second, a fingerprinting script dubbed UltimateFingerprinter (file name 5b4c8fea5cbcee273e8d830f52-temfp.js, about 2.3 MB, 98% AngularJS dead code around an embedded minified payload) runs 61 collectors that aggregate 394 JSON fields (canvas, audio, WebGL, fonts, WebRTC, media devices, battery, sensors, USB/NFC/Bluetooth, Apple-specific features). It refuses delivery when the screen size is not phone-like (e.g. 99999) or maxTouchPoints is 0, and uses a short-lived VDGH_TOKEN_REF replay-guard cookie (about one minute despite a days=1 misconfiguration). Third, platform-specific n-day exploit chains are fetched from nonce-based endpoints such as /api/[NONCE]/v1, /v2 and /v3 on static.flux-telemetry[.]com.

Three exploit classes were observed. Class A (iOS 16.7) chains CVE-2025-43529 (WebContent RCE) with CVE-2024-27834 (PAC bypass) and steals browser cookies; CVE-2024-27808 and CVE-2024-27833 are present as dead code. Class B (iOS 18.5) is nearly identical to the publicly disclosed DarkSword kit: /v1 uses CVE-2025-43529 plus CVE-2026-20700 (PAC bypass), /v2 sandbox escape uses CVE-2025-14174 and CVE-2025-43510, and /v3 kernel read/write uses CVE-2025-43520, with CVE-2025-31277 and CVE-2025-24201 left as unused alternates. The post-exploitation harvester collects sms.db and iMessage, mail indexes, voicemail, WhatsApp and Telegram databases, Keychain credentials, Wi-Fi PSKs, contacts, call history, Safari history and cookies, Health data, the photo library and iCloud Drive. Class C (Android Chrome 139-145) uses CVE-2026-3910 (Chrome renderer RCE, a V8 Maglev type confusion that Google TAG confirmed as exploited in the wild before the Chrome 146.0.7680.75 fix and that CISA lists in KEV) followed by CVE-2025-27038 (Adreno GPU driver sandbox escape), then drops AndroSnitch (internal name libexploit.so). AndroSnitch has 16 data-collection functions, was built with Clang/LLD 14.0.7, uses libcurl with a hardcoded device token, steals Chrome Cookies, Login Data, History and WifiConfigStore.xml, and stops on the Samsung Galaxy S25 Ultra (SM-S938B).

Stolen data is sent by HTTPS POST to ad.starx-net[.]com:8881/telemetry/v12 with Filename and X-Device-Id headers. The exploits install no persistence and no RAT; victims have to be re-exposed to the watering hole. In the Plerdy supply-chain compromise, the Ukrainian SEO tracker file https://a.plerdy[.]com/public/js/click/main.js was altered between Aug 27 and Sep 3, 2026, affecting thousands of mostly Ukrainian sites. edge-ord.clouds-stacks[.]com acted as a load balancer to ads-it-assets[.]com, cdn.adv-static[.]com, wpvortex-mod[.]com and assets-int[.]com. Victim sites include Ukrainian military recruitment and defense-sector sites (ballistic and UAV manufacturers), a Ukrainian gas production company, a US chemical industry trade association, a Czech far-right political party site, a Bulgarian military-related site, america250.org, Raffles London (close to UK government institutions) and an Australian medical clinic.

Sekoia attributes the activity to APT29 with moderate to high confidence, citing the overlap with the 2024 APT29 watering holes against Mongolian government sites that Google TAG reported (re-use of exploits matching NSO Group and Intellexa work), multi-hoster infrastructure (Shock Hosting AS395092, servinga AS219399, EDIS AS9009/AS57169), European and Ukrainian victimology, and leftover artifacts from a 2025 APT29 campaign on one compromised site. Sekoia also notes that the iOS version filter (16.7 only) does not match the chain's capability (16.0-17.4), which suggests third-party kit reuse. Separately, public reporting on DarkSword (in use since at least November 2025) notes that several actors have used it, including the Russian state-linked cluster UNC6353 against Ukraine. The source states no CVSS score for the campaign; severity is analyst-assigned.

## MITRE ATT&CK

- T1592 Gather Victim Host Information
- T1583.001 Domains
- T1608.004 Drive-by Target
- T1195.002 Compromise Software Supply Chain
- T1203 Exploitation for Client Execution
- T1480 Execution Guardrails
- T1497 Virtualization/Sandbox Evasion
- T1539 Steal Web Session Cookie
- T1557 Adversary-in-the-Middle
- T1555.003 Credentials from Web Browsers
- T1555.001 Keychain
- T1005 Data from Local System
- T1071.001 Web Protocols
- T1571 Non-Standard Port
- T1588.005 Exploits
- T1189 Drive-by Compromise
- T1059.007 JavaScript
- T1068 Exploitation for Privilege Escalation
- T1082 System Information Discovery
- T1041 Exfiltration Over C2 Channel

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**APT29 DarkSword / AndroSnitch Payload and Chain Component File Artifacts** (`TL-2026-5214-SPL-002`)

Detects file artifacts of the APT29 mobile exploit chains: the 13 published SHA-256 hashes of Class A/B iOS chain components and the DarkSword-style harvester, the Class C Android Chrome exploits, shellcode and AndroSnitch (libexploit.so, a Chrome Cookies/Login Data/History and WifiConfigStore.xml stealer), as well as libexploit.so and the UltimateFingerprinter file 5b4c8fea5cbcee273e8d830f52-temfp.js by name. Covers triage artifacts, sandbox or forensic extractions and endpoints that cached or downloaded chain components.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1203, T1068, T1555.003, T1555.001, T1539, T1005
- **Data sources:** sysmon (index=sysmon, EventCode 1/7/11/15), DeviceFileEvents (Microsoft Defender for Endpoint), Linux file_event telemetry (Sigma category file_event, product linux)
- **Severity:** critical
- **Confidence:** high

### Splunk SPL

```spl
index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" earliest=-30d (Hashes IN ("*bee3e014e3df87ddce0250b0985b87f6868a427a7b650a74b7ffedb9d57f3088*","*a7d2493df00565c21587b0cad2a9fe7ca1e5590acf796da6e499be0ffde44cc3*","*35c0cd19a7334b544c193e392bcd9a8f1d1f43cf6b61be5bf1d9e35537aff2ef*","*621112712ec515e8791129c62feda8fff6654a0116882401609503cacc08054a*","*69b6cb327a4d5da99399718f6a66f84de69f89425b0a31f2dcee0682f811596f*","*c170fda024183645c0aa681149304e50506509c3498bb6b9a5f5ced6aa73e5fa*","*ae3241d96cc2d99538c7aff60f382cc8dac13859bcbea3ee84992d24d22a8108*","*41e6fd33a30d36dabff9ea408d9766a6583edcc107968f6dc1499f2586381967*","*183d62d682aea8018491c8559544e8d6a9ab0e1abd05ecbb6c97daa4f438d2b8*","*387a7fb768db1350a9788d9704e7a72abe07152734e0ff026af72b417e36268c*","*29d283ebd08d0cd3b2e6f4a67718d3d6e7a6be01d0613d716bce218dba57a928*","*06c17b31d36838f3d29044784aa047d5c2d9174d3356c1211cf25f9df677445f*","*2ffb35e3f9e55286a930fb887e73764a913166648135fe0ca7551736d97d7bfa*") OR TargetFilename IN ("*libexploit.so","*5b4c8fea5cbcee273e8d830f52-temfp.js") OR Image="*libexploit.so") | fillnull value="n/a" User Image TargetFilename Hashes | stats earliest(_time) as first_seen latest(_time) as last_seen count values(Hashes) as hashes by Computer, User, Image, TargetFilename, EventCode | eval first_seen=strftime(first_seen,"%Y-%m-%d %H:%M:%S"), last_seen=strftime(last_seen,"%Y-%m-%d %H:%M:%S") | table first_seen last_seen Computer User EventCode Image TargetFilename hashes count
```

### Microsoft KQL

```kql
let IocSha256 = dynamic(['bee3e014e3df87ddce0250b0985b87f6868a427a7b650a74b7ffedb9d57f3088','a7d2493df00565c21587b0cad2a9fe7ca1e5590acf796da6e499be0ffde44cc3','35c0cd19a7334b544c193e392bcd9a8f1d1f43cf6b61be5bf1d9e35537aff2ef','621112712ec515e8791129c62feda8fff6654a0116882401609503cacc08054a','69b6cb327a4d5da99399718f6a66f84de69f89425b0a31f2dcee0682f811596f','c170fda024183645c0aa681149304e50506509c3498bb6b9a5f5ced6aa73e5fa','ae3241d96cc2d99538c7aff60f382cc8dac13859bcbea3ee84992d24d22a8108','41e6fd33a30d36dabff9ea408d9766a6583edcc107968f6dc1499f2586381967','183d62d682aea8018491c8559544e8d6a9ab0e1abd05ecbb6c97daa4f438d2b8','387a7fb768db1350a9788d9704e7a72abe07152734e0ff026af72b417e36268c','29d283ebd08d0cd3b2e6f4a67718d3d6e7a6be01d0613d716bce218dba57a928','06c17b31d36838f3d29044784aa047d5c2d9174d3356c1211cf25f9df677445f','2ffb35e3f9e55286a930fb887e73764a913166648135fe0ca7551736d97d7bfa']);
DeviceFileEvents
| where Timestamp > ago(30d)
| where SHA256 in~ (IocSha256) or FileName in~ ('libexploit.so', '5b4c8fea5cbcee273e8d830f52-temfp.js')
| project Timestamp, DeviceName, ActionType, FolderPath, FileName, SHA256, InitiatingProcessFileName, InitiatingProcessAccountName
| order by Timestamp desc
```

### Sigma

```yaml
title: APT29 AndroSnitch libexploit.so and UltimateFingerprinter File Artifacts
id: e2b9a6d4-0f73-4c15-b8e6-9a41c7d5f204
status: experimental
description: Detects creation of the AndroSnitch payload library libexploit.so (Chrome Cookies, Login Data, History and WifiConfigStore.xml stealer) or the UltimateFingerprinter script 5b4c8fea5cbcee273e8d830f52-temfp.js on Linux-based hosts, emulators or forensic images (TL-2026-5214). Hash-based coverage of the 13 chain component SHA-256 values is provided in the SPL and KQL forms.
references:
  - https://www.sekoia.com/blog/poisoned-source-apt29-watering-holes-targets-mobile-devices-with-n-day-exploits
author: AII-Detector — ThreadLinqs Intelligence
date: 2026/11/04
tags:
  - attack.execution
  - attack.t1203
  - attack.privilege-escalation
  - attack.t1068
  - attack.credential-access
  - attack.t1555.003
  - attack.t1539
  - attack.collection
  - attack.t1005
  - cve.2026.3910
  - cve.2025.27038
logsource:
  category: file_event
  product: linux
detection:
  selection:
    TargetFilename|endswith:
      - '/libexploit.so'
      - '/5b4c8fea5cbcee273e8d830f52-temfp.js'
  condition: selection
falsepositives:
  - Unrelated software that happens to ship a library named libexploit.so (for example exploit-development or test frameworks)
  - Analysts storing malware samples on monitored hosts
level: high
```

**Known false positives:**

- Analysts or sandboxes storing the published malware samples on monitored endpoints
- Unrelated software or test frameworks shipping a library named libexploit.so

**Tuning notes:** Native iOS and Android devices rarely forward file telemetry, so this rule mainly fires on analyst workstations, sandboxes, emulators, Chromebook/Linux endpoints, mobile forensic extractions and EDR agents that scan downloaded files. Keep filename matching but prefer hash matches for fidelity; refresh the hash list from the Sekoia IOC set. Exclude your malware-analysis lab hosts after confirming ownership. Complements MDM hash/threat alerts for the AndroSnitch payload (387a7fb7...).

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- APT29 Plerdy Supply-Chain Compromise - Redirect to Watering-Hole Delivery Domains (locked: unlock with TL Creds)
- APT29 Exploit Chain Progression - Multiple Staged Endpoints Fetched by One Client (locked: unlock with TL Creds)
- APT29 Campaign Infrastructure - Connections to Known IPs and Non-Standard Port 8881 Egress (locked: unlock with TL Creds)
- APT29 Watering Hole - Look-Alike Reverse-Proxy and Delivery Domains (locked: unlock with TL Creds)
- APT29 UltimateFingerprinter Script and VDGH_TOKEN_REF Replay-Guard Cookie (locked: unlock with TL Creds)
- APT29 Watering Hole Campaign - DNS Resolution of Delivery, Redirect and Exfiltration Domains (locked: unlock with TL Creds)
- APT29 Watering Hole - Nonce-Based Exploit Stage Retrieval from [indicator] (locked: unlock with TL Creds)
- APT29 Mobile Data Exfiltration - HTTPS POST to [indicator]:8881/telemetry/v12 (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sample indicators (3 of 36)

Defanged, TLP:CLEAR.

- IP address: `109.104.106[.]107`
- Domain: `static[.]flux-telemetry[.]com`
- URL: `hxxps://a[.]plerdy[.]com/public/js/click/main.js`

Full set of 36 indicators unlocks with TL Creds: https://threadlinqs.com/tl-creds

## Sources

- [Poisoned Source: APT29 watering holes target mobile devices with n-day exploits (Sekoia)](https://www.sekoia.com/blog/poisoned-source-apt29-watering-holes-targets-mobile-devices-with-n-day-exploits)
- [DarkSword exploit kit steals iPhone data (The Register)](https://theregister.com/2026/03/18/darksword_exploit_kit_steals_iphone)
- [DarkSword iOS exploit kit uses 6 flaws (The Hacker News)](https://thehackernews.com/2026/03/darksword-ios-exploit-kit-uses-6-flaws.html)
- [DarkSword iOS exploit kit used by state-sponsored hackers and spyware vendors (SecurityWeek)](https://www.securityweek.com/darksword-ios-exploit-kit-used-by-state-sponsored-hackers-spyware-vendors/amp/)
- [CVE-2026-3910 Known Exploited Vulnerability detail (CVEfeed)](https://cvefeed.io/vuln/detail/CVE-2026-3910)
- [CISA adds Google Chrome flaws to its Known Exploited Vulnerabilities catalog (Security Affairs)](https://securityaffairs.com/?p=189411)
- [APT29, NSO Group and Intellexa mobile exploits - Mongolia watering holes (Security Affairs)](https://securityaffairs.com/167797/apt/apt29-nso-group-and-intellexa-mobile-exploits.html)
- [Mongolian government sites hit by APT29 watering holes using NSO Group and Intellexa exploits (The Record)](https://therecord.media/mongolia-apt29-watering-hole-attacks-exploits-nso-group-intellexa)
- [Commercial spyware exploits used by Russia against Mongolia (The Register)](https://www.theregister.com/2024/08/29/commercial_spyware_russia_mongolia/)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-5214