● Covered by 2 sources · 2 reportsMedium impact2 negative
Russian State-Linked Group Midnight Blizzard Targets iOS, Android Devices in Espionage Campaign
Key points
- Midnight Blizzard (APT29) targeted iOS and Android users in Europe and the US.
- The campaign used watering hole attacks via compromised or cloned high-profile websites.
- Malicious JavaScript fingerprinted devices before delivering zero-click exploits.
- Stolen data included passwords, messages, emails, and browser information.
- Affected sites included a Ukrainian gas company, a US trade association, and a Bulgarian military site.
Overview of the Campaign
Russian state-sponsored threat actor Midnight Blizzard, also known as APT29 or Cozy Bear, has been identified targeting iOS and Android users in Europe and the United States. The campaign involved watering hole attacks, where compromised or cloned websites were used to deliver exploits to visitors.
The objective of these attacks was to steal sensitive information from mobile devices, including passwords, messages, emails, and browser data. The attacks were often zero-click, meaning they did not require user interaction to compromise the device.
Attack Methodology
Midnight Blizzard injected malicious JavaScript code into legitimate websites, including those of a Ukrainian gas production company, a major industry trade association, and a far-right European political party. They also modified legitimate files on a Bulgarian military-related website. Additionally, the group created fake versions of popular websites and compromised a Ukrainian web analytics service.
The injected code was designed to fingerprint visitors by harvesting browser and device configuration data, which was then sent in JSON format. This fingerprinting occurred before the exploit delivery, often utilizing previously patched n-day vulnerabilities.
Targeted Regions and Organizations
The campaign primarily focused on users in Ukraine, the United States, and various European countries, including the Czech Republic and Bulgaria. Organizations whose websites were compromised included a Ukrainian gas production company, a major U.S. chemical industry trade association, and a Bulgarian military-related website.
Midnight Blizzard, believed to be sponsored by the Russian Foreign Intelligence Service (SVR), is known for intelligence gathering and typically targets government organizations, diplomats, IT services providers, and NGOs.
Impact and Data Compromised
The attackers were able to steal a range of sensitive data from vulnerable devices. This included passwords, messages, emails, and browser data. The zero-click nature of some exploits allowed for compromise without users needing to click on malicious links or download files.
✨ This summary was generated by AI from the outlets' reporting listed below. It is not independently verified and may contain errors — check the original sources. How BrevFeed works →
The daily brief
One email each morning: the day's tech stories, clustered across outlets and summarized. No account needed.
One email a day. Unsubscribe in one click, any time.
Today's brief
Spend a few minutes, get the whole day. Every topic's top stories in one hands-free rundown — listen, watch, or read the transcript.
▶ Play today's brief
New every morning, and the back catalogue is archived by date.
How outlets covered it
Russian state-linked hacking group APT29 (Cozy Bear) conducted a zero-click espionage campaign targeting iPhone and Android users in Ukraine, the U.S., and Europe. The attackers compromised legitimate websites, created fake sites, and injected malicious code into a Ukrainian web analytics service to steal sensitive data.
Russian state-sponsored threat actor Midnight Blizzard (APT29) conducted a watering hole campaign, compromising websites to deliver exploit chains targeting iOS and Android devices. The attacks used previously patched vulnerabilities and aimed to fingerprint visitors before delivering exploits, impacting users in Europe and the US.