Kremlin-linked hackers exploited patched iOS and Android flaws via malicious websites

Exploitation of Patched Mobile Flaws

Researchers reported that hackers, assessed with moderate to high confidence as part of Russia’s Foreign Intelligence Service, exploited previously patched vulnerabilities in iOS and Android. These attacks aimed to compromise mobile devices of visitors to various websites, including one related to the 250th anniversary of American independence.

Attack Vector and Payload

The attacks began when iPhone or Android users accessed one of potentially hundreds of compromised sites. Malicious JavaScript injected into the web traffic profiled the visiting device. The final payloads, customized for each platform, attempted to exfiltrate browser cookies, and in some instances, Wi-Fi passwords and full mobile device data.

Targeted Websites

One of the impersonated sites was america250.org, belonging to a non-partisan group. Attackers registered america250[.]holiday and used it as a reverse proxy to deliver content from the legitimate site with added malicious JavaScript. Researchers from Sekoia suggested this site was chosen due to its high-profile national celebration association, potentially for spear-phishing campaigns.

Another targeted site, theowo[.]club, proxied the website for Raffles of London OWO, a luxury hotel located near sensitive UK government institutions like the Ministry of Defence and 10 Downing Street. Ukrainian President Volodymyr Zelenskyy reportedly stayed at this hotel during a visit.

Attribution and Motivation

The researchers linked the attackers to Russia's Foreign Intelligence Service. Many of the targeted sites had connections to the ongoing conflict in Ukraine, suggesting geopolitical motivations behind the cyber espionage efforts.