Sekoia Says APT29 Poisoned a Ukrainian Analytics Script for a Week to Serve iPhone and Android Exploits. Every Flaw Was Already Patched. Update Your Phones and Check Your Sites.
If your iPhone or Android phone is not on current software, update it today. Sekoia reports that a campaign it calls Poisoned Source used only bugs that were already patched, and says the chains do not work on fully updated devices. If you run a website that loads the Plerdy SEO Tracker, check whether your pages served its script between August 27 and September 3.
Sekoia published the report on November 4 and assesses with moderate to high confidence that the campaign was run by APT29, the Russian intrusion set widely attributed to the SVR. This post is a summary of Sekoia's work, with the parts a defender can act on first.
What Sekoia found
Sekoia found the campaign in mid-October after spotting a compromised website belonging to a Ukrainian gas production company. It then found other compromised sites: a trade association for the U.S. chemical industry, a far-right Czech movement website, and a Bulgarian military-related website. Sekoia does not name any of them. It also found two lookalike sites, one copying the America250 site and one copying a London hotel, that relay the real site's content while loading the attacker's script. Those are called adversary-in-the-middle copies. The hotel copy is now offline.
The week the tracker was poisoned
Plerdy is a Ukrainian web analytics service. Sekoia reports that between August 27 and September 3, 2026, the tracker file Plerdy serves was modified so that, on page load, it also pulls in a fingerprinting script from an attacker-controlled domain. Any site that embedded the tracker loaded it. Sekoia says that domain redirected requests to other delivery servers, which it assesses was load balancing.
The fingerprinting script profiles the visitor's device and browser. The attacker's server then pushes the exploit chain that matches, or nothing if nothing matches.
Three chains, all against patched bugs
Chain | Target | Bugs | What it does |
A | iOS 16.7 | Steals Safari cookies | |
B | iOS 18.5 | The DarkSword chain. Press summaries of the report list messages, WhatsApp and Telegram data, Keychain credentials, location and photos. | |
C | Chrome for Android 139 to 145, except 143 | Installs AndroSnitch, which takes Chrome cookies, saved logins, history and saved Wi-Fi credentials. The chain stops if the phone is a Galaxy S25 Ultra (model SM-S938B). |
Sekoia says all of the chains use known, already-patched vulnerabilities and do not work on fully updated devices. None of the payloads set up persistence, so a reboot ends the compromise until the phone visits an affected page again.
Some coverage calls this zero-click. The accurate version is visit-only: loading an affected page is enough, and nothing needs to be tapped, but a person still has to load the page.
How sure is the attribution
Sekoia's wording is "moderate to high confidence", and its conclusion softens that to "APT29, or at least one of its subgroups". It bases the call on technical overlaps, operational patterns, the choice of victims, and infrastructure, and it cites a CERT report of a 2025 APT29 watering hole and Google's Threat Analysis Group noting similarities with a 2024 campaign in Mongolia. We cannot check any of that ourselves. Treat the actor name as Sekoia's judgment, not a fact.
What to do
If you own a phone: install the current iOS or Android security update, and update Chrome. The targeted builds are iOS 16.7, iOS 18.5 and Chrome 139 to 145.
If you run a website: find out whether you embed the Plerdy SEO Tracker. If you do, check your logs or page captures from August 27 to September 3 for requests to the domains below, and tell your visitors if you find any.
If you defend a network: block the indicators below, and search proxy and DNS logs back to August 27 for the domains. A POST to the exfiltration host on port 8881 is the strongest signal that a device was served.
Indicators
These are defanged. The hashes are in the feed.
Fingerprinting and delivery: static.flux-telemetry[.]com (109.104.106[.]107), edge-ord.clouds-stacks[.]com (95.133.231[.]28), adsprism-stat[.]com, ads-it-assets[.]com, cdn.adv-static[.]com, wpvortex-mod[.]com, assets-int[.]com
Exfiltration: ad.starx-net[.]com (195.58.140[.]105), port 8881, path /telemetry/v12
Lookalike sites: america250[.]holiday (192.121.46[.]25), theowo[.]club (188.190.17[.]232)
Do not block a.plerdy[.]com. It is a real service and the victim here, not an attacker domain.
What we hold
We ingested Sekoia's published network indicators and its nine file hashes, credited to Sekoia, under the source label manual-batch-apt29-poisoned-source-2026-11: five IP addresses, ten domains and nine hashes, at confidence 85. We did not ingest a.plerdy[.]com, the real america250.org site that the lookalike proxies, or the public DarkSword kit sample that Sekoia cites only as a reference.
Before ingesting, we looked up the three delivery and exfiltration IP addresses and two of the domains. None were in our corpus. That means this is not a detection lead. We read Sekoia's report like everyone else. The free feed carries the indicators at https://analytics.dugganusa.com/stix/register.
Limits
We read Sekoia's report and two press summaries of it. We did not run anything, and we did not see a sample. Sekoia says its full delivery and exfiltration host lists and its YARA rules are in its commercial product, so this list may be a subset. The report does not label its hash type; all nine are 64 hexadecimal characters, which is the length of SHA-256. The report does not say whether the Plerdy file has been restored.
Five percent of this is wrong somewhere. It always is. The numbers will move again before you finish reading.
Was this useful? Rate this post. The widget is at the bottom of the page, and we read every response.
Every indicator in this post is in the feed. Free.
1.58M+ IOCs, STIX 2.1 / TAXII, 88% novel vs ThreatFox, exploited-CVE leads ahead of CISA. No credit card — a free API key in 30 seconds, and you can audit every claim above against the live endpoints.
Comments