MalwarePublished
Poisoned Source: APT29 Watering Holes Targets Mobile Devices
Source AlienVault OTX General
0
Mentions 8 CVEs
Mentioned vulnerabilities
Description
A large-scale watering hole campaign attributed with moderate-to-high confidence to APT29 targets mobile devices by compromising legitimate websites, impersonating high-profile domains, and supply-chain compromising a Ukrainian analytics service. The campaign uses injected JavaScript to profile devices and deliver platform-specific n-day exploits against iOS and Android. Exploited vulnerabilities include multiple CVEs from 2024 to 2026. The final payloads exfiltrate sensitive data such as browser cookies, Wi-Fi passwords, and device information without establishing persistence, consistent with intelligence-gathering objectives.
Indicators of compromise
Domains 6
- static.flux-telemetry.com
- edge-ord.clouds-stacks.com
- ad.starx-net.com
- theowo.club
- america250.holiday
- adsprism-stat.com
URLs 6
- http://ad.starx-net.com:8881/telemetry/v12
- https://ad.starx-net.com/api/
- https://ad.starx-net.com:8881/telemetry/v12
- https://edge-ord.clouds-stacks.com/module/5b4c8fea5cbcee273e8d830f52-temfp.js
- https://static.flux-telemetry.com/api/uGmlx2pmMHU1jq7wZU2QWgeC28vbXalf/v1'
- https://static.flux-telemetry.com/module/5b4c8fea5cbcee273e8d830f52-temfp.js'
IP addresses 1
- 95.133.231.28
Hashes 13
CVEs 12
- CVE-2024-27834
- CVE-2024-27808
- CVE-2024-27833
- CVE-2025-43510
- CVE-2025-43520
- CVE-2025-14174
- CVE-2025-43529
- CVE-2026-20700
- CVE-2025-24201
- CVE-2025-31277
Community reviews
Loading reviews…