The most striking detail in Sekoia's report is not the sophistication of the campaign but how little it needed to succeed. The exploit chains targeted flaws that were already disclosed and patched. The attackers were not relying on secret zero-days. They were relying on phones that had not been updated.
The campaign used three delivery routes: scripts injected into legitimate websites, lookalike domains that proxied real sites while adding malicious scripts, and a roughly week-long compromise of Plerdy, a Ukrainian website analytics tracker. Plerdy is loaded by thousands of mostly Ukrainian websites, and Sekoia said the compromise, which ran from August 27 to September 3, exposed hundreds of them and their visitors. Because the payloads were delivered through ordinary sites, a visitor needed no interaction to be fingerprinted and served an exploit matched to their device.
Sekoia assessed with moderate to high confidence that the activity belongs to APT29, also tracked as Midnight Blizzard and Cozy Bear, or one of its subgroups. The researchers also said their analysis supported the idea that APT29 obtained the exploits from a third party. That matters. It suggests a state intelligence service buying capability rather than building it, and it reinforces the case that the commercial exploit market is subsidising espionage against ordinary users.
The report also leaves important gaps. Sekoia did not say how many devices were compromised. The lookalike domains and the exposed sites were varied, and the scope of the Plerdy incident is described only as hundreds of sites. Readers should treat those figures as the limits of what has been established, not as a full count of victims.
What should happen next is not complicated, even if it is hard to deliver. Users should install operating system updates promptly, and Sekoia's own limit is worth repeating: a user running an up-to-date operating system is safe from these attacks. Website operators who load third-party scripts should audit them, and analytics vendors should treat their distribution channels as high-value targets. Governments that tolerate or depend on a market for exploits should accept that every unpatched device becomes part of the battlefield.