Hackers possibly linked to the Kremlin have exploited previously patched vulnerabilities in iOS and Android to target visitors of several high-profile websites, including one commemorating the 250th anniversary of American independence, according to researchers from security firm Sekoia. The attacks, which began when users accessed potentially hundreds of different sites, involved injecting malicious JavaScript into the traffic to profile devices and steal sensitive information.
The attackers, assessed with “moderate to high confidence” to be affiliated with Russia’s Foreign Intelligence Service, utilized a reverse proxy technique to deliver malicious content. One of the impersonated sites was america250.org, associated with a bipartisan group of lawmakers and business leaders. The attackers registered a lookalike domain, america250[.]holiday, which served as a conduit for injecting harmful scripts into the legitimate site.
Exploiting High-Profile Events
Researchers noted that the choice of the america250.org site may have been strategic, leveraging the high-profile nature of the national celebration to facilitate spear-phishing campaigns. “We assess that the intrusion set may have deliberately selected this website due to its association with a high-profile national celebration,” Sekoia stated.
Another targeted site, theowo[.]club, acted as a proxy for Raffles of London OWO, a luxury hotel near key UK government institutions, including the Ministry of Defence and 10 Downing Street. Notably, Ukrainian President Volodymyr Zelenskyy was reported to have stayed at this hotel during a visit in mid-October.
Technical Details of the Attack
The attack vector involved JavaScript that profiled the device of the user visiting the compromised sites. The final payloads were tailored based on the platform being used, aiming to extract browser cookies, Wi-Fi passwords, and comprehensive mobile device data. This method highlights the ongoing threat posed by state-linked actors, particularly in the context of geopolitical tensions.
As the situation evolves, the implications of these attacks underscore the need for heightened vigilance among users and organizations, particularly those associated with sensitive national events or government operations. The exploitation of previously patched vulnerabilities serves as a reminder of the persistent risks in the cybersecurity landscape.
For further details on the vulnerabilities exploited in these attacks, refer to Sekoia’s analysis.
These incidents illustrate the critical importance of maintaining robust cybersecurity measures and staying informed about potential threats, especially as state-sponsored cyber activities continue to evolve.
