From Ars Technica · · 1m 40s
Russian hackers hit iPhones and Androids via websites
Kremlin-linked attackers exploited patched flaws to infect visitors to hundreds of sites, including one marking America's 250th anniversary.
In brief
Kremlin-linked attackers exploited patched flaws to infect visitors to hundreds of sites, including one marking America's 250th anniversary. Russia's Foreign Intelligence Service exploited already-patched iOS and Android flaws to target visitors of multiple websites, including america250.org, researchers said…
Kremlin hackers target phone users
Attackers assessed with moderate to high confidence as part of Russia's Foreign Intelligence Service exploited patched iOS and Android flaws to infect website visitors.
How the attack worked
JavaScript injected into website traffic profiled each device. Tailored payloads then attempted to steal browser cookies, Wi-Fi passwords, and full mobile device data from iPhone and Android users.
America250 website impersonated
Attackers registered america250.holiday as a reverse proxy to america250.org, belonging to a non-partisan group of lawmakers and business executives. Researchers assessed the selection was deliberate, leveraging the 250th anniversary celebration for spear-phishing campaigns.
Luxury hotel near UK government targeted
A second impersonated site, theowo.club, proxied Raffles of London OWO, a luxury hotel near the Ministry of Defence and 10 Downing Street. Ukrainian President Volodymyr Zelenskyy stayed there during a visit on October 14.
Supply chain and direct compromises
Attackers also compromised websites including a top Ukrainian gas production company and a Ukrainian web analytics service serving thousands of websites. Three infection vectors delivered the same injected JavaScript to profile visitors.
Exploits required outdated software
All vulnerabilities exploited were n-days, already patched.Attacks worked only on outdated iOS or Android versions.One chain was DarkSword, an iOS exploit kit previously used by PARS Defense and at least two other threat actors.
At a glance
Russia's Foreign Intelligence Service exploited already-patched iOS and Android flaws to target visitors of multiple websites, including america250.org, researchers said Wednesday.
