Affected Systems

Plerdy SEO Tracker (compromised August 27 - September 3, 2026); iOS devices running 16.7 and 18.5; Android devices running Chrome 139-145 (excluding 143); websites using Plerdy analytics script (a.plerdy[.]com/public/js/click/main.js); compromised legitimate sites in US, Ukraine, Czech Republic, Bulgaria including chemical industry, military, and political party websites.

Exploitation Status

Active exploitation confirmed. APT29 deployed watering hole attacks in mid-October 2026 using N-day exploits: iOS exploits leverage CVE-2025-43529, CVE-2024-27834, CVE-2026-20700, CVE-2025-14174, CVE-2025-43510, CVE-2025-43520 via DarkSword kit; Android exploits use CVE-2026-3910, CVE-2025-27038 via AndroSnitch payload. Supply chain compromise of Plerdy occurred August 27 - September 3, 2026.

Business Impact

Organizations using Plerdy SEO Tracker exposed visitors to mobile device compromise during the August-September 2026 window. Successful exploitation results in theft of browser cookies, Wi-Fi passwords, and on iOS 18.5 devices, full data exfiltration including SMS/iMessages, email databases, WhatsApp/Telegram data, iCloud Keychain, contacts, call history, photos, and health data. High-value targets include defense, military, chemical industry, and government sectors. Attackers used commercial surveillance vendor (CSV) exploit kits (DarkSword, Coruna) lowering technical barriers for state-sponsored mobile exploitation. Data exfiltrated to ad.starx-net[.]com:8881/telemetry/v12.

Urgency

🔴 Immediate

Recommended Actions

  • Immediately audit web properties for Plerdy SEO Tracker script (a.plerdy[.]com/public/js/click/main.js) and remove or replace with alternative analytics solution until vendor confirms remediation
  • Update iOS devices to latest available version beyond 18.5; update Android Chrome browsers to version 146 or later to patch CVE-2026-3910 and CVE-2025-27038
  • Block network traffic to known C2 infrastructure: ad.starx-net[.]com, america250[.]holiday, ad-track[.]live at perimeter and DNS level
  • Review web server logs from August 27 - October 2026 for JavaScript injection indicators and connections to starx-net[.]com; correlate with mobile device access logs for iOS 16.7/18.5 and Chrome 139-145 user agents
  • Force password and session token resets for users who accessed affected websites from mobile devices during the compromise window, prioritizing high-value personnel in defense, government, and critical infrastructure roles

---

# Threat Actor Context

Actor Profile

APT29 (also tracked as IRON RITUAL, IRON HEMLOCK, NobleBaron, Dark Halo) is a Russia-linked advanced persistent threat group attributed to this large-scale watering hole campaign codenamed "Poisoned Source." The actor demonstrates sophisticated capabilities in supply chain compromise, mobile exploitation, and targeted intelligence collection. APT29 is known for strategic operations aligned with Russian state interests, particularly in the context of geopolitical conflicts such as the Russia-Ukraine war. This campaign reflects the group's evolution toward mobile platform targeting and their adoption of commercial surveillance vendor (CSV) exploit frameworks.

TTPs (Tactics, Techniques, Procedures)

APT29 employed multiple initial access vectors including watering hole attacks via compromised legitimate websites (T1189 implied), supply chain compromise of Plerdy SEO Tracker (T1195.2 implied), and typosquatting domains. The campaign utilized JavaScript-based profiling and staging (T1059.007 implied), followed by platform-specific N-day exploit chains. For iOS: CVE-2025-43529, CVE-2024-27834 (Class A); CVE-2025-43529, CVE-2026-20700, CVE-2025-14174, CVE-2025-43510, CVE-2025-43520 via DarkSword kit (Class B). For Android: CVE-2026-3910, CVE-2025-27038 targeting Chrome 139-145. The actor performed data from local system collection (T1005) including browser cookies, credentials, messaging databases, and device data, with exfiltration to C2 infrastructure (T1041 implied). Known APT29 techniques from MITRE include T1621 (Multi-Factor Authentication Request Generation), T1003.002 (Security Account Manager), T1588.002 (Tool acquisition), T1090.004 (Domain Fronting), T1528 (Steal Application Access Token), T1568 (Dynamic Resolution), T1068 (Exploitation for Privilege Escalation), T1546.003 (WMI Event Subscription), T1547.001 (Registry Run Keys), T1136.003 (Cloud Account creation), T1098.005 (Device Registration), T1587.003 (Digital Certificates), and T1105 (Ingress Tool Transfer).

Targets & Patterns

The campaign targeted iOS and Android mobile device users visiting compromised websites in strategically significant sectors. Confirmed targets include a major U.S. chemical industry trade association, a far-right European political party, Bulgarian military-related websites, and sites related to army, special forces, and military equipment (ballistic systems, UAVs). The supply chain compromise of Ukrainian web analytics service Plerdy SEO Tracker (August 27 - September 3, 2026) amplified reach across customer websites. Typosquatting domains impersonated high-profile sites in the U.S. (america250[.]holiday), Ukraine, Czech Republic, and Bulgaria. Target selection suggests intelligence collection against high-value individuals with strategic importance to the Russia-Ukraine conflict, including military personnel, defense industry stakeholders, and political entities. The campaign's watering hole methodology indicates either targeted surveillance of specific visitor populations or opportunistic mass compromise for selective exploitation of valuable intelligence.

Historical Context

This campaign represents an evolution of APT29's mobile exploitation capabilities previously observed in August 2024, when Google documented a watering hole attack against a Mongolian government website using the ANDROSNATCH payload (Chrome exploits CVE-2024-5274, CVE-2024-4671). The current operation reuses similar Android cookie-stealing techniques via the AndroSnitch payload, demonstrating tactical continuity. APT29 has historically deployed malware families including PinchDuke, WellMail, CozyCar, TrailBlazer, OnionDuke, FatDuke, POSHSPY, EnvyScout, and SoreFang. The Poisoned Source campaign marks increased reliance on commercial surveillance vendor (CSV) exploit frameworks like DarkSword and Coruna, lowering technical barriers for advanced mobile exploitation. The supply chain attack vector echoes APT29's sophisticated tradecraft seen in previous high-profile operations, adapted here for mobile platforms in the context of ongoing Russia-Ukraine geopolitical tensions.

Defensive Recommendations

  • Monitor for suspicious JavaScript injections in web analytics and third-party scripts; implement Subresource Integrity (SRI) checks and Content Security Policy (CSP) headers to detect unauthorized modifications to external resources like Plerdy or similar services
  • Deploy mobile device management (MDM) solutions to enforce iOS and Android patch compliance; prioritize updates addressing CVE-2025-43529, CVE-2024-27834, CVE-2026-20700, CVE-2025-14174, CVE-2025-43510, CVE-2025-43520 (iOS) and CVE-2026-3910, CVE-2025-27038 (Android Chrome)
  • Implement network monitoring for exfiltration to suspicious domains matching patterns like ad.starx-net[.]com:8881/telemetry/* and ad-track[.]live; block known APT29 C2 infrastructure and monitor for dynamic DNS resolution (T1568)
  • Conduct threat hunting for watering hole indicators on high-value websites; review web server logs for unauthorized JavaScript modifications and anomalous access patterns to analytics script endpoints
  • Enable mobile threat detection capabilities to identify exploit kit behaviors such as DarkSword and Coruna; monitor for unauthorized data access to browser cookies, messaging databases (WhatsApp, Telegram, iMessage), Wi-Fi credentials, and keychain data on managed devices

---

# Geopolitical Context

Geopolitical Context

The campaign, designated Poisoned Source, represents a sophisticated multi-vector operation consistent with APT29's established tradecraft. The threat actor, widely attributed to Russia's Foreign Intelligence Service (SVR), deployed watering hole attacks across strategically selected websites—including a U.S. chemical industry association, a far-right European political party, and Bulgarian military sites—alongside a supply chain compromise of Ukraine-based Plerdy SEO Tracker between August 27 and September 3, 2026. The targeting pattern suggests intelligence collection priorities aligned with the Russia-Ukraine conflict, particularly given the focus on military equipment, special forces, and defense-related websites. The operation demonstrates continued Russian investment in mobile exploitation capabilities and willingness to compromise third-party infrastructure in adversary or contested territories. The use of commercial surveillance vendor (CSV) tooling—specifically the DarkSword and Coruna exploit kits—indicates state actors are increasingly leveraging packaged N-day exploit chains to reduce operational costs and technical barriers for advanced mobile device compromise.

State Actor Alignment

APT29 is widely attributed to Russia's Foreign Intelligence Service (SVR) by Western intelligence agencies and cybersecurity vendors. The group remains subject to U.S., EU, and allied sanctions frameworks targeting Russian intelligence entities. The compromise of Ukrainian digital infrastructure (Plerdy) is consistent with Russia's documented pattern of targeting Ukrainian technology providers and supply chains as part of broader hybrid warfare operations. The watering hole selection—spanning U.S. industrial associations, European political entities, and Bulgarian military sites—aligns with SVR collection priorities regarding NATO member states, transatlantic economic interests, and regional security dynamics in Eastern Europe. The operation's technical sophistication and resource investment reflect capabilities typically associated with well-resourced state intelligence services rather than criminal or hacktivist groups.

Business Impacty pro region

The campaign carries significant implications for European cybersecurity posture and transatlantic digital resilience. The compromise of a Ukrainian service provider underscores ongoing risks to Ukraine's technology sector amid sustained Russian cyber operations, potentially eroding confidence in Ukrainian digital services among Western partners. The targeting of Bulgarian military websites and a far-right European political party suggests Russian intelligence interest in NATO's eastern flank and European political movements that may influence sanctions policy or military support for Ukraine. For U.S. entities, the compromise of a major chemical industry association website demonstrates that even well-resourced American organizations remain vulnerable to watering hole attacks when visiting legitimate but compromised third-party sites. The campaign's mobile focus—targeting iOS and Android devices used by high-value individuals—represents an escalation in operational risk for government officials, military personnel, and corporate executives traveling in or engaging with European theaters. The reuse of commercial exploit frameworks indicates a proliferation risk, as these tools may become available to additional state or non-state actors over time.

Forecast

If APT29 continues leveraging commercial surveillance vendor exploit chains, the operational tempo and scale of mobile device compromise campaigns targeting Western government and defense personnel are likely to increase, particularly as N-day vulnerabilities remain unpatched across enterprise mobile fleets. Should Ukrainian technology providers face additional supply chain compromises, European and U.S. organizations may implement stricter vetting or geographic restrictions on third-party scripts and analytics services, potentially fragmenting the digital services market along geopolitical lines. If the DarkSword and Coruna kits continue to evolve and proliferate, additional state-sponsored groups—particularly those aligned with or operating in proximity to Russian intelligence priorities—may adopt similar mobile exploitation techniques, broadening the threat landscape beyond traditional APT29 targeting. In the near term, organizations with personnel engaged in Russia-Ukraine conflict-related activities, defense procurement, or Eastern European policy should anticipate sustained watering hole and supply chain risks, necessitating enhanced mobile device management, network segmentation, and threat hunting focused on JavaScript injection vectors.