APT29 Linked to Mobile Watering Hole Campaign Using n-Day Exploit Chains

Security Affairs reports, based on research published by Sekoia, that a large-scale watering hole campaign is targeting iOS and Android users. Sekoia first spotted the campaign in mid-October 2026 on the website of a Ukrainian gas production company. Compromised sites included websites in the US, Ukraine, the Czech Republic and Bulgaria, and the Ukrainian web analytics service Plerdy was compromised in a supply-chain attack that affected thousands of websites, most of them Ukrainian.

Sekoia also identified two fake websites, one copying America250 and another reproducing the website of Raffles London at The OWO, a luxury hotel near the UK Ministry of Defence and Downing Street. Sekoia believes the hotel site may have been used to target diplomatic delegations through spear-phishing, but says this remains unconfirmed. Sekoia cannot say whether the attackers aimed at specific visitors or at as many unpatched phones as possible.

Sekoia pulled three exploit chains from the delivery server. Class B is DarkSword, which Sekoia describes as a suspected iOS exploit kit from a commercial surveillance vendor. The Android payload, which Sekoia calls AndroSnitch, collects Chrome cookies, saved logins and history, and Wi-Fi settings. According to Sekoia, all the chains rely on known flaws fixed by their vendors before the campaign began, and none uses a zero-day.

Why it matters For security teams, the campaign shows that visitors can be infected on sites they trust, including through a third-party analytics script, so script inventories and third-party tag monitoring matter as much as endpoint patching. Mobile users on unpatched iOS and Android versions remain exposed to these n-day chains, while Sekoia's report indicates that fully updated devices are not affected. Investigators should note the reported indicators, the UltimateFingerprinter script and the reuse of a commercial exploit kit as a sign that state-backed groups are adopting packaged mobile exploits.