"a user running an up-to-date operating system is safe from these attacks," Sekoia wrote on November 4, 2026.
Delivery methods: watering holes, lookalikes and a tainted analytics plugin
Sekoia reported a multi-pronged watering‑hole campaign discovered in mid‑October 2026 that served exploit chains to visitors of legitimate sites. The researchers identified three delivery routes: scripts injected directly into legitimate websites, lookalike domains that proxied real sites while inserting malicious scripts, and a week‑long compromise of Plerdy, a Ukrainian website analytics tracker. The lookalike domains impersonated the America250 initiative and a London hotel; exposed legitimate sites included a Ukrainian gas producer, multiple Ukrainian military and military‑equipment sites, a US chemical‑industry trade association, a Czech far‑right movement, and a Bulgarian military‑related site.
Vulnerabilities, platforms and what was taken
Sekoia found the campaign used exploit chains that relied entirely on n‑day flaws — vulnerabilities already disclosed and patched. The research lists eight CVEs used by the attackers: CVE‑2025‑43529, CVE‑2024‑27834, CVE‑2026‑20700, CVE‑2025‑14174, CVE‑2025‑43510, CVE‑2025‑43520, CVE‑2026‑3910 and CVE‑2025‑27038. The chains were device‑specific: one targeted iOS 16.7 to steal browser cookies; a second chain, based on the DarkSword exploit kit (which Sekoia described as suspected to have been developed by a commercial surveillance vendor), targeted iOS 18.5 to collect full device data; a third targeted Chrome 139 through 145 on Android (excluding version 143) to harvest browser cookies and Wi‑Fi passwords. According to Sekoia, the payloads were designed to steal cookies, device data and Wi‑Fi passwords without any user interaction, and the delivered malware did not establish persistence on infected devices.
This site is the portfolio.
OSINTSights runs on Cloudflare Workers, D1, R2, and Vectorize, with an AI pipeline on Hetzner ARM. Nubivance designed, built, and operates it. We do the same for clients.
See what we buildThe Plerdy compromise expanded the net
Plerdy, the analytics tool loaded by thousands of mostly Ukrainian websites, was compromised from August 27 to September 3, 2026. Sekoia said that compromise exposed hundreds of Plerdy‑using sites and their visitors to the exploit kit; the researchers did not disclose how many devices were ultimately compromised. Because Plerdy is embedded widely across Ukrainian sites, the short‑duration intrusion significantly broadened which visitors could be fingerprinted and matched to an exploit chain.
Attribution and exploit sourcing
Sekoia assessed with moderate to high confidence that the activity was the work of APT29 — also tracked as Midnight Blizzard and Cozy Bear — or at least one of its subgroups. The group is widely attributed to Russia's Foreign Intelligence Service (SVR), the report notes. Sekoia's analysis further supported the conclusion that the exploit chains were obtained from a third party rather than developed in‑house, a detail the researchers highlighted when discussing the use of n‑day flaws and the DarkSword kit.
What this means for technologists, affected enterprises, and end users
- Technologists and security teams: Expect fingerprinting and device‑specific exploit delivery. Sekoia's findings show attackers matched exploit chains to visitor device versions (for example, iOS 16.7 vs. iOS 18.5 or specific Chrome versions), so patch management and device‑version awareness are central to mitigation.
- Affected enterprises and procurement leaders: Third‑party components such as analytics tools can extend attackers’ reach quickly. The Plerdy compromise — active for just one week — exposed hundreds of embedded sites. Organizations that embed third‑party scripts should prioritize rapid vetting and incident playbooks for tainted vendors.
- End users and the general public: The practical limit of the threat is clear in Sekoia's assessment — up‑to‑date operating systems block these exploit chains. Users running patched OS and browser versions are, in Sekoia's words, "safe from these attacks."
The campaign is notable for its breadth and operational bluntness: unlike an earlier APT29 campaign described in a 2024 Google report that used a hardcoded filter to limit targets to specific Mongolian government sites, this iteration collected any cookies present in a victim's browser and had no such filter. Visitors were fingerprinted and served the exploit chain that matched their device, widening the pool of potential victims.
Sekoia’s timeline and technical mapping leave a clear tactical lesson: attackers can rapidly amplify access by compromising widely embedded third‑party scripts and by sourcing ready‑made exploit chains. The report also leaves one practical question unresolved in its public disclosure — how many devices were actually compromised — a gap Sekoia explicitly noted when it declined to provide device counts. Until that scale is clarified, the incident stands as a reminder that timely patching and cautious treatment of third‑party web components remain primary defenses.
