Threat Intelligence Brief
Curated summary with source attribution
Source: thehackernews.com
Threat Risk: High
Victim: Government, military, and industrial personnel
Incident: A large-scale watering hole and supply chain campaign targeting mobile devices via compromised web scripts.
Impact: Theft of browser cookies, Wi-Fi passwords, and comprehensive mobile device data.
Attacker: APT29
Analysis: APT29 utilized a triple-threat approach involving compromised websites, lookalike domains, and a supply chain attack on the Plerdy SEO Tracker. The attackers deployed JavaScript loaders to profile visitors and serve tailored exploit chains, including the DarkSword kit for iOS. The campaign specifically targeted high-value individuals within the chemical industry and military sectors.
Recommendations: Update all iOS and Android devices to the latest security patches to mitigate N-day exploits.; Audit third-party JavaScript and analytics scripts for unauthorized modifications.; Implement strict Content Security Policies (CSP) to prevent the execution of unauthorized external scripts.
Source: The Hacker News
Editorial note: this post summarizes third-party reporting and links to the original source.
View Original Source