Russian APT29 group uses fake US and UK websites to target mobile visitors
THREAT ACTORAPT29redteam/daily · 1 source
- Severity
- High
- Sources
- 1
What happened
A large-scale watering hole campaign, assessed with moderate to high confidence as APT29 (Cozy Bear, Midnight Blizzard), used compromised websites, cloned US and UK domains and a poisoned component to deliver mobile exploits to iOS and Android visitors. The attribution is linked to Russia's SVR. The excerpt is truncated and names no CVE IDs, affected OS versions or specific indicators. Defenders should review the full report for IOCs and exploit details before drawing conclusions.
For security analysts · Written by AI from 1 source · Wrong?
What to do
- No action needed.
Written by AI from the sources, checked against them
Full story timeline · 1 update
Who reported · 1 outlet
GBHackers
Who and what is in it
Threat actors