Sekoia has attributed a cyberespionage campaign to APT29, a group widely linked to Russia's Foreign Intelligence Service (SVR). The firm assessed the attribution with moderate to high confidence, saying the group may be APT29 or one of its subgroups.
The activity was uncovered in mid-October 2026 and detailed in research published on November 4. The campaign served exploit chains for already-patched iPhone and Android flaws to visitors of legitimate websites. The payloads were built to steal cookies, device data and Wi-Fi passwords without any user interaction.
Attackers used three delivery routes. They injected scripts into legitimate websites, set up lookalike domains that proxied real sites while adding scripts, and compromised Plerdy, a Ukrainian website analytics tracker, for about a week. Sekoia said the Plerdy compromise ran from August 27 to September 3 and exposed hundreds of mostly Ukrainian websites and their visitors to the exploit kit. The researchers did not say how many devices were compromised.
Exposed sites included a Ukrainian gas producer, Ukrainian military and military-equipment sites, a US chemical-industry trade association, a Czech far-right