Russian state-sponsored threat actor Midnight Blizzard is believed to have targeted iOS and Android users in Europe and the US with zero-click exploits targeting n-day vulnerabilities, cybersecurity firm Sekoia reports.
Also known as APT29, Cozy Bear, The Dukes, Nobelium, and Yttrium, and believed to be sponsored by the Russian Foreign Intelligence Service (SVR), Midnight Blizzard is known for targeting government organizations, diplomats, IT services providers, and NGOs for intelligence gathering.
The attacks uncovered by Sekoia, mounted as part of a large-scale watering hole campaign, involved compromised or cloned high-profile websites of organizations in the US, Ukraine, the Czech Republic, and Bulgaria.
Midnight Blizzard injected malicious JavaScript code in the websites of a Ukrainian gas production company, a major industry trade association, and a far-right European political party, and modified legitimate files on the site of a Bulgarian military-related website.
The code was designed to fingerprint visitors, harvesting browser and device configuration data and sending it in JSON format before the exploit is delivered.
In an adversary-in-the-middle (AiTM) setup, the APT registered two lookalike domains that acted as reverse proxies for high-profile sites, injecting malicious code into copies of america250.org, the site of the 250th anniversary of American independence, and the website of the Raffles London at The OWO hotel near sensitive UK government institutions.
“By doing this watering hole impersonation of the Raffles London at The OWO, the intrusion set may have sought to target diplomatic delegations and high-profile guests through targeted spear-phishing campaigns. Recent open-source reporting, for example, indicates that Ukrainian President Volodymyr Zelensky stayed at Raffles London during a visit on 14 October,” Sekoia notes.
The hackers also targeted Ukrainian web analytics service Plerdy in a supply chain attack, adding their malicious code to the tracker file. This exposed hundreds of websites to the exploit kit for one week, including army, special forces, and military equipment (ballistic, UAV) sites.
Sekoia identified three exploit chains (two targeting iOS and one targeting Android) used across the campaign. All three target previously patched vulnerabilities, and the iOS chains rely heavily on the DarkSword exploit kit that was uncovered earlier this year.
The first reimplements the initial remote code execution (RCE) code from DarkSword for arbitrary read/write access, and then exploits CVE-2024-27834 to bypass Apple’s Pointer Authentication Codes (PAC) protection and execute code that steals cookies outside of Safari.
CVE-2024-27834 was patched in May 2024 in iOS 17.5 and iPadOS 17.5, iOS 16.7.8 and iPadOS 16.7.8, macOS Sonoma 14.5, Safari 17.5, tvOS 17.5, watchOS 10.5. On Wednesday, CISA added the flaw to its KEV catalog, telling federal agencies to patch it within two weeks.
The second chain relies solely on DarkSword for initial access, code execution, and privilege escalation. The final payload was designed to fully harvest the device: messages, emails, voicemails, credentials, tokens, contacts, calls, calendar entries, browser cookies and history, photos, and iCloud Drive content.
Midnight Blizzard’s last exploit chain targets Android users via CVE-2026-3910, a Chrome vulnerability patched in March as a zero-day, and CVE-2025-27038, a Qualcomm bug patched with Android’s August 2025 security update.
The final payload, AndroSnitch, targets data stored in Chrome, including cookies, account information, passwords, browser history, and Wi-Fi passwords. It is similar to AndroSnatch, a Chrome cookie stealer Google TAG observed in Midnight Blizzard attacks mounted between 2023 and 2024.
“The adoption of packaged n-day exploit chains lowers the cost and technical threshold required to conduct advanced mobile exploitation. Over the long term, we assess that the proliferation and reuse of CSV [Commercial Surveillance Vendor] exploits among state-sponsored intrusion sets will likely become more frequent,” Sekoia notes.
Related: Rigged Coding Assignment, Abused AI Tool Opened Path to $6 Billion Binance Heist
Related: Iran’s Prince of Persia APT Hosts C&C in US for First Time Since 2016
Related: Russian APT Star Blizzard Uses ‘RedFlick’ Infection Chain in Recent Attacks
Related: Anthropic Says Russian Hackers Used Claude AI to Automate Malware Evasion
