Possibly Kremlin-linked hackers exploited patched iOS and Android flaws
Hackers possibly linked to the Kremlin exploited previously patched iOS and Android flaws in an attempt to hack visitors of multiple websites, researchers said Wednesday. One of the sites was built around the 250th anniversary of American independence. Researchers from the security firm Sekoia assessed, with "moderate to high confidence", that the attackers were part of Russia's Foreign Intelligence Service. The attackers also targeted other sites, many of them with links to Russia's ongoing war against Ukraine.
An attack began when an iPhone or Android user visited one of potentially hundreds of different sites. JavaScript injected into the traffic then profiled the device. The final payloads were tailored to the type of platform visiting. They attempted to steal browser cookies and, in some cases, Wi-Fi passwords and full mobile device data.
One impersonated site was america250.org, which belongs to a non-partisan group of lawmakers, business executives, and at least one former member of the Trump administration. The attackers registered america250[.]holiday and used it as a reverse proxy to the real site. The imposter delivered the genuine site's content with malicious JavaScript added to it. Sekoia said: "We assess that the intrusion set may have deliberately selected this website due to its association with a high-profile national celebration, potentially leveraging the event as a pretext for invitation-themed spear-phishing campaigns."
A second imposter, theowo[.]club, proxied the website of Raffles of London OWO, a luxury hotel physically close to some of the UK's most sensitive government institutions, including the Ministry of Defence and 10 Downing Street, the official residence and office of the British Prime Minister. Open source reporting indicates that Ukrainian President Volodymyr Zelenskyy stayed there during a visit on October 14.
Key facts
- Researchers said Wednesday that hackers possibly linked to the Kremlin exploited previously patched iOS and Android flaws against visitors of multiple websites.
- Sekoia assessed with "moderate to high confidence" that the attackers were part of Russia's Foreign Intelligence Service.
- The attackers ran reverse-proxy imposter sites, america250[.]holiday and theowo[.]club, which served real content with malicious JavaScript added.
- The JavaScript profiled each device, and platform-specific payloads tried to steal browser cookies and, in some cases, Wi-Fi passwords and full mobile device data.
- An attack could begin on any of potentially hundreds of different sites; many targets had links to Russia's war against Ukraine.
Why it matters
The campaign targeted both major mobile platforms with flaws that had already been patched, and it relied on lookalike sites that served genuine content, so a visitor would see the real page. The choice of sites is telling: one tied to a major American national celebration, another a London hotel near the Ministry of Defence and 10 Downing Street, and others linked to the war in Ukraine. The attribution is to Russia's Foreign Intelligence Service, with moderate to high confidence.
Who it affects
Anyone with an iPhone or Android phone who visited one of the affected sites. The article says an attack could begin on one of potentially hundreds of different sites. The impersonated sites included america250.org, which belongs to a non-partisan group of lawmakers, business executives, and at least one former member of the Trump administration, and the website of Raffles of London OWO. Many other targeted sites had links to Russia's war against Ukraine.
How to use it
This is a threat report, not a product. The one defensive fact in the available text is that the exploited flaws were previously patched. The text is cut off before any mitigations or vendor responses, and it does not name the specific vulnerabilities.
How solid is it
The attribution rests on Sekoia's assessment, stated at "moderate to high confidence", and the article opens with "possibly linked to the Kremlin". It is not a definitive finding. The claim that the america250 site was chosen as a pretext for invitation-themed spear-phishing is framed by Sekoia only as something that "may have" happened and "potentially" was intended. The Zelenskyy detail comes from open source reporting. The article text available is cut off partway through, so later evidence is not covered here.
Risks and caveats
The visible text names no CVE identifiers and gives no number of victims or confirmed infections. It does not say that Zelenskyy or other hotel guests were targeted or compromised. It does not say that spear-phishing using the america250 pretext actually took place. The section heading "Wielding DarkSword" appears but the available text does not explain the term. The year of the October 14 visit is not stated.
“We assess that the intrusion set may have deliberately selected this website due to its association with a high-profile national celebration, potentially leveraging the event as a pretext for invitation-themed spear-phishing campaigns”
— Researchers from security firm Sekoia