APT29 Watering-Hole Campaign Against Mongolian Government Sites Using iOS WebKit and Chrome Android Exploits (CVE-2023-41993, CVE-2024-5274, CVE-2024-4671)

Key facts for APT29 Mongolia watering holes

Detection coverage for APT29 Mongolia watering holes

As of 2026-11-05, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-5340 across Splunk SPL, Microsoft KQL and Sigma, covering 20 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: APT29 Mongolia Watering Hole — Contact with track-adv.com / ceo-adviser.com Exploit Infrastructure

Detects web-proxy/web-datamodel traffic to track-adv.com and ceo-adviser.com, the attacker-controlled domains that received traffic from malicious iframes injected into compromised Mongolian government sites (cabinet.gov.mn, mfa.gov.mn, mga.gov.mn) and served the iOS WebKit (CVE-2023-41993) and Chrome Android (CVE-2024-5274 + CVE-2024-4671) exploit chains attributed by Google TAG to APT29. Hits on the known stager/stealer endpoints (market-analytics.php, analytics.php?personalization_id, fb-connect.php) are escalated as likely exploit delivery or cookie theft (VALIDVICTOR / COOKIESNATCH / ANDROSNATCH).

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1189, T1659, T1583.001, T1203
• Data sources: splunk_cim_web_datamodel, web_proxy_logs, DeviceNetworkEvents, CommonSecurityLog
• Severity: high
• Confidence: high

Splunk SPL

| tstats summariesonly=false count min(_time) as firstTime max(_time) as lastTime values(Web.url) as urls values(Web.http_user_agent) as user_agents from datamodel=Web.Web where (Web.url="*track-adv.com*" OR Web.url="*ceo-adviser.com*" OR Web.dest="track-adv.com" OR Web.dest="ceo-adviser.com") by Web.src Web.user Web.dest
| rename Web.* as *
| eval stage=if(match(mvjoin(urls,"|"),"(?i)market-analytics[.]php|personalization_id|fb-connect[.]php"),"exploit_or_stealer_endpoint","attacker_domain_contact")
| eval firstTime=strftime(firstTime,"%F %T"), lastTime=strftime(lastTime,"%F %T")
| table firstTime lastTime src user dest stage count urls user_agents

Microsoft KQL

let attackerDomains = dynamic(["track-adv.com","ceo-adviser.com"]);
union
(DeviceNetworkEvents
    | where Timestamp > ago(24h)
    | where RemoteUrl has_any (attackerDomains)
    | project TimeGenerated = Timestamp, Source = "DeviceNetworkEvents", Device = DeviceName, User = InitiatingProcessAccountUpn, Process = InitiatingProcessFileName, Url = RemoteUrl, RemoteIP),
(CommonSecurityLog
    | where TimeGenerated > ago(24h)
    | where RequestURL has_any (attackerDomains) or DestinationHostName has_any (attackerDomains)
    | project TimeGenerated, Source = "CommonSecurityLog", Device = SourceIP, User = SourceUserName, Process = RequestClientApplication, Url = RequestURL, RemoteIP = DestinationIP)
| sort by TimeGenerated desc

Sigma

title: APT29 Mongolia Watering Hole - Proxy Contact With track-adv.com or ceo-adviser.com
id: 3f1a7c52-8d4e-4b19-a6c3-5e2b9d7f0a11
status: experimental
description: Detects proxy traffic to track-adv.com and ceo-adviser.com, attacker domains used in the 2023-2024 APT29 watering-hole campaign against Mongolian government sites (CVE-2023-41993, CVE-2024-5274, CVE-2024-4671).
references:
    - https://blog.google/threat-analysis-group/state-backed-attackers-and-commercial-surveillance-vendors-repeatedly-use-the-same-exploits/
    - https://attack.mitre.org/groups/G0016/
author: AII-Detector — ThreadLinqs Intelligence
date: 2026/11/05
tags:
    - attack.initial-access
    - attack.t1189
    - attack.t1659
    - attack.resource-development
    - attack.t1583.001
    - attack.execution
    - attack.t1203
    - attack.g0016
    - cve.2023-41993
    - cve.2024-5274
    - cve.2024-4671
logsource:
    category: proxy
detection:
    selection:
        cs-host|endswith:
            - 'track-adv.com'
            - 'ceo-adviser.com'
    condition: selection
falsepositives:
    - Security researchers or threat-intel teams deliberately browsing the indicator domains (sandbox egress)
level: high

Known false positives:

• Threat-intel analysts or sandboxes that intentionally resolve and fetch the indicator domains
• Security tooling replaying published IOC lists against the proxy

Tuning notes: Ensure the proxy sourcetype is CIM-tagged into the Web datamodel with url, dest, src and user populated (accelerate it and drop summariesonly=false for speed). Exclude sandbox egress ranges. Treat any hit with stage=exploit_or_stealer_endpoint as a confirmed-exposure case: check device OS/browser version (iOS <=16.6.1, Chrome Android m121-m123), revoke sessions and rotate credentials. No OSINT corroboration exists for these IOCs (TL_OSINT_Scan); sourcing is Google TAG only.

• 🔒 APT29 Mongolia Watering Hole — DNS Resolution of Attacker Domains · unlock with TL Creds
• 🔒 ANDROSNATCH — Chrome Crash Report Deletion Following c.so Injection · unlock with TL Creds
• 🔒 APT29 Stolen Cookie Replay — Sign-In From New IP After Exposure to Attacker Infrastructure · unlock with TL Creds
• 🔒 APT29 VALIDVICTOR / COOKIESNATCH Beacon Endpoints — market-analytics.php, personalization_id, fb-connect.php · unlock with TL Creds
• 🔒 APT29 Mobile Payload Hash Match — VALIDVICTOR, COOKIESNATCH, ANDROSNATCH, Chrome Recon · unlock with TL Creds
• 🔒 APT29 Watering Hole Iframe Chain — Mongolian Government Site Referrer to Attacker Domain · unlock with TL Creds
• 🔒 ANDROSNATCH — LD_PRELOAD Injection of [indicator] into Chrome · unlock with TL Creds
• 🔒 APT29 COOKIESNATCH / ANDROSNATCH — HTTP POST Exfiltration to Attacker Domains · unlock with TL Creds

Indicators of compromise for APT29 Mongolia watering holes

As of 2026-11-05, Threadlinqs Intelligence tracks 20 indicators of compromise for TL-2026-5340.

Sample indicators (3 of 20)

• Domain: track-adv[.]com
• File hash: 8bd9a73da704b4d7314164bff71ca76c15742dcc343304def49b1e4543478d1a
• Domain: ceo-adviser[.]com

Defanged, TLP:CLEAR. Full set of 20 indicators: unlock with TL Creds.

How APT29 Mongolia watering holes works

TAG states the exploits were identical or strikingly similar to those previously used as zero-days by commercial surveillance vendors Intellexa and NSO Group.

Between November 2023 and July 2024, Google's Threat Analysis Group (TAG) observed multiple watering-hole campaigns delivered from compromised Mongolian government websites, including the Cabinet (cabinet.gov.mn) and Ministry of Foreign Affairs (mfa.gov.mn); BleepingComputer additionally lists mga.gov.mn. Malicious iframes injected into the sites loaded attacker-controlled content from track-adv.com and ceo-adviser.com. TAG assesses with moderate confidence that the activity is attributable to APT29 (Midnight Blizzard / Cozy Bear), partly because the iOS cookie-stealer framework matches one used in a March 2021 Russian government-backed campaign that exploited CVE-2021-1879 against Western European officials.

The iOS campaigns (November 2023 and February 2024) targeted iOS 16.6.1 and older using CVE-2023-41993, a WebKit flaw patched in iOS 16.7 and previously exploited as a zero-day by Intellexa in September 2023. TAG reports the exploit used the exact same trigger as Intellexa's. A reconnaissance payload (VALIDVICTOR) profiled the device (canvas fingerprinting for iPhone model, screen size, CPU count, GPU, User-Agent and client hints, per-session identifiers), followed by a cookie stealer (COOKIESNATCH) that targeted 14 hardcoded domains including Gmail, Microsoft, LinkedIn, Yahoo, Facebook, GitHub and iCloud, using WebSocket manipulation by traversing pointer sets, and exfiltrated cookies to attacker servers. Lockdown Mode users were protected.

The July 2024 Android campaign targeted Chrome m121-m123 and chained CVE-2024-5274 (V8 type confusion; a slightly modified version of the exploit NSO Group used as a zero-day in May 2024) with CVE-2024-4671 (Visuals use-after-free sandbox escape; similar to prior Intellexa exploits). After the sandbox escape, the ANDROSNATCH payload deleted Chrome crash reports, exfiltrated Chrome databases (cookies, passwords, account data, history, trust tokens), and was delivered via LD_PRELOAD injection of /data/data/com.android.chrome/c.so. A Chrome reconnaissance payload profiled victims first. Chrome Site Isolation meant the renderer exploit alone was insufficient, requiring the sandbox escape.

All three vulnerabilities were patched before the campaigns used them (n-day exploitation), but remained effective against unpatched devices. TAG notes that the origin of the exploit code is unknown; possible routes discussed in coverage include compromise of vendor networks, insiders, direct collaboration or purchase from brokers, none confirmed. Mitigations: patch iOS and Chrome, enable iOS Lockdown Mode, and use Safe Browsing (updated with the identified domains).

MITRE ATT&CK techniques by tactic:

Collection

T1005 Data from Local System

Defense Evasion

T1070.004 File Deletion

Discovery

T1082 System Information Discovery

Execution

T1203 Exploitation for Client Execution

Credential Access

T1539 Steal Web Session Cookie; T1555.003 Credentials from Web Browsers

stealth

T1574.006 Dynamic Linker Hijacking

Resource Development

T1583.001 Domains

Reconnaissance

T1592 Gather Victim Host Information

Initial Access

T1659 Content Injection

Remediation for APT29 Mongolia watering holes

Patches

• CVE-2023-41993: iOS/iPadOS 16.7, Safari 17, macOS Sonoma 14.0
• CVE-2024-4671: Chrome 124.0.6367.201
• CVE-2024-5274: Chrome 125.0.6422.112

Immediate actions

• Update iOS/iPadOS to 16.7 or later (current supported release) and Chrome on Android to 125.0.6422.112 or later
• Block track-adv.com and ceo-adviser.com at DNS and proxy
• Review web and proxy logs for requests to market-analytics.php, analytics.php and fb-connect.php on the listed domains
• Enable iOS Lockdown Mode for high-risk users

Workarounds

• Enable Lockdown Mode on iOS
• Keep Chrome Site Isolation enabled
• Revoke and rotate sessions and credentials for accounts accessed from potentially exposed devices

Longer-term hardening

• Enforce rapid mobile OS and browser patching via MDM
• Monitor sessions for cookie replay and impossible-travel for SaaS accounts
• Monitor government and partner websites for injected iframes or unexpected third-party scripts

Affected and fixed versions

• Apple — iOS / iPadOS (WebKit)
  Vulnerable versions: 16.6.1 and older
  Fixed in: 16.7
• Google — Chrome for Android
  Vulnerable versions: m121-m123; before 124.0.6367.201 (CVE-2024-4671); before 125.0.6422.112 (CVE-2024-5274)
  Fixed in: 124.0.6367.201; 125.0.6422.112

Timeline of APT29 Mongolia watering holes

• 2021-03-01 March 2021 (month precision): Russian government-backed actor exploits CVE-2021-1879 against Western European government officials using a cookie-stealer framework later reused in the Mongolia campaign
• 2023-09-21 Apple patches CVE-2023-41993 (iOS 16.7), exploited as a zero-day by locked-ioc-19 in September 2023
• 2023-09-25 CISA adds CVE-2023-41993 to the Known Exploited Vulnerabilities catalog
• 2023-11-01 November 2023 (month precision): first iOS watering-hole campaign on Mongolian government sites delivering the CVE-2023-41993 exploit
• 2024-02-01 February 2024 (month precision): second iOS watering-hole iteration on the compromised Mongolian sites
• 2024-05-13 CISA adds CVE-2024-4671 (Chrome Visuals use-after-free) to KEV; fixed in Chrome 124.0.6367.201
• 2024-05-28 CVE-2024-5274 (Chrome V8 type confusion, exploited by locked-ioc-20 as a zero-day in May 2024) published and added to KEV; fixed in Chrome 125.0.6422.112
• 2024-07-01 July 2024 (month precision): Android campaign chains CVE-2024-5274 and CVE-2024-4671 against Chrome m121-m123 to deploy the locked-ioc-16 cookie and credential stealer
• 2024-08-29 Google TAG publishes its report attributing the campaigns to APT29 with moderate confidence and updating Safe Browsing with the identified domains

Sources cited for APT29 Mongolia watering holes

• NVD - CVE-2023-41993 NVD (NIST) · Advisory · 2023-09-21
• NVD - CVE-2024-5274 NVD (NIST) · Advisory · 2024-05-28
• NVD - CVE-2024-4671 NVD (NIST) · Advisory · 2024-05-14
• CISA Known Exploited Vulnerabilities Catalog CISA · Government advisory · 2024-05-28
• State-backed attackers and commercial surveillance vendors repeatedly use the same exploits (Google TAG) Google · Vendor report · 2024-08-29
• APT29 utilizes exploits for Chrome and iOS made by spyware companies - Active IOCs (Rewterz) rewterz.com · Research
• Russian APT29 hackers use iOS, Chrome exploits created by spyware vendors (BleepingComputer) BleepingComputer · News · 2024-08-29
• APT29 watering-hole attacks use exploits from NSO Group and Intellexa (The Record) The Record · News · 2024-08-29
• APT29, NSO Group and Intellexa mobile exploits (Security Affairs) securityaffairs.com · News · 2024-08-30
• Russia's APT29 using spyware exploits in new campaigns (TechTarget) techtarget.com · News

More in apt

• CRAFTY FALCON targets Indian fintechs via exposed APIs during weekends and low-monitoring periods
• Chinese Nation-State Threat Activity Falls 41.4% in Q2-Q3 2026 While Remaining Above Russian and Iranian Activity (Trellix)
• APT29 (Midnight Blizzard) watering holes target iOS and Android devices with n-day exploit chains (DarkSword, AndroSnitch)
• Gorbag: Russia-aligned espionage group targets Ukrainian war crimes investigations and military aid routes (BeautyStealer, Prime ReverseShell, CVE-2025-8088)
• ARTEX Agentic AI Penetration-Testing Framework Abused by China-Aligned Actors Storm-0940 and VAPOR PANDA to Automate Enterprise and Cloud Intrusions