THE CRUNCH
A Russian state-linked hacking group ran a wide espionage campaign targeting iPhones and Android devices in Ukraine, the United States and Europe, according to a report by French cybersecurity firm Sekoia. The firm attributes the operation to APT29, also known as Cozy Bear or Midnight Blizzard, a group widely believed to act for Russia's foreign intelligence service. The attackers planted malicious code on legitimate websites, built fake versions of popular sites and compromised a Ukrainian web analytics service, in some cases stealing data without any click or download from the victim.
The stolen material included passwords, messages, emails, browser data and, on some iPhones, contacts, photos and location history. The methods varied by device: attacks on iPhones running iOS 16 sought browser and application cookies, while a more advanced toolkit called DarkSword, a suspected commercial surveillance product, could pull a much broader haul from iPhones running iOS 18.5. On Android, the hackers exploited flaws in older versions of Chrome to take browsing data, cookies and saved Wi-Fi passwords.
The most far-reaching operation targeted Plerdy, a Ukrainian analytics service used by thousands of websites, where malicious code in a tracking script could expose visitors to sites linked to the Ukrainian military, special forces and drone manufacturers. The hackers also spoofed the America250 anniversary initiative and the Raffles London hotel, the latter apparently aimed at diplomats and high-profile guests. Sekoia found no evidence that President Zelensky, who reportedly stayed at the Raffles in October, was targeted.
One important qualification: all three attack methods relied on flaws that Apple and Google had already patched before the campaign began. Sekoia said no zero-day vulnerabilities were used, and the attacks would not work against fully updated devices. The firm could not establish how many phones were compromised and is working with national computer emergency response teams to identify victims and disrupt the hackers' infrastructure.