As reported by SecurityAffairs, Sekoia has uncovered a large-scale watering hole campaign attributed to APT29 (also tracked as Cozy Bear, Nobelium, Midnight Blizzard, and The Dukes) — the Russian SVR-linked group responsible for some of the most consequential intrusions of the past decade. What sets this campaign apart is not the adversary, but the operational sophistication: three distinct delivery vectors converging on a single mobile payload, with a supply-chain compromise of the Ukrainian analytics platform Plerdy amplifying reach across thousands of websites.

Threat Intelligence: As reported by SecurityAffairs, Sekoia has uncovered a large-scale watering hole campaign attributed to APT29 (also tracked as Cozy Bear, Nobelium, Midnight Blizzard, and The Dukes) — the Russian SVR-linked group responsible for some of the most consequential intrusions of the past decade.

Why This Campaign Demands Attention

APT29 has historically focused on strategic espionage targets — government agencies, diplomatic missions, think tanks, and critical infrastructure suppliers. This campaign fits that profile but introduces a critical shift: the group is now investing in mobile-device access as a primary collection vector. Mobile devices have long been a blind spot for enterprise defenders, often sitting outside MDM enrollment, EDR coverage, and network perimeter controls. A nation-state group that recognizes this gap and builds reliable delivery mechanisms to exploit it is a meaningful escalation.

The use of a compromised third-party analytics service (Plerdy) is particularly significant. Supply-chain compromises at the JavaScript layer are notoriously difficult to detect because the malicious code executes within the context of trusted websites that organizations have no reason to suspect. This is the same class of attack that powered the Magecart phenomenon and the 2024 Polyfill.io incident, but weaponized by an APT with far more targeted objectives.

Targeting Patterns and Strategic Implications

Targeting Patterns and Strategic Implications
Diplomatic and government-adjacent targeting: The fake Raffles London at The OWO website — a reverse proxy of a luxury hotel housed in the historic Old War Office building — appears designed to intercept visitors connected to diplomatic delegations. The reported overlap with a Ukrainian presidential visit timeline is a strong indicator of precision targeting rather than opportunism.
Geopolitical alignment: Compromised sites span Ukraine, the US, the Czech Republic, and Bulgaria — all NATO members or partners actively opposing Russian aggression. This is consistent with SVR collection priorities.
Multi-vector redundancy: By deploying direct website compromises, cloned sites, and a supply-chain vector simultaneously, APT29 ensures that even if one delivery channel is discovered and remediated, others remain active.
The combination of supply-chain amplification and precision-crafted lure sites suggests APT29 is casting both a wide net and a highly targeted one — a dual approach that lets them collect broadly while preserving the ability to reach specific high-value individuals.

Who Is Most at Risk

Defenders should assume this campaign is not opportunistic. Primary risk populations include:

  • Diplomatic personnel and government officials traveling to or transiting the UK, Ukraine, and Eastern Europe
  • Defense industry employees and contractors, particularly those associated with NATO partner organizations
  • Journalists, policy researchers, and NGO staff covering Russian geopolitical interests
  • Any organization whose staff regularly browse Ukrainian or Eastern European websites that may have loaded the compromised Plerdy analytics script

Shield53 Recommendations

Immediate Actions

  • Audit third-party scripts: Conduct an immediate review of all externally loaded JavaScript on your organization's public-facing websites. Verify the integrity of analytics, tag manager, and SDK scripts against vendor-published checksums. If your organization uses Plerdy, treat it as potentially compromised and remove or replace the script until the vendor confirms remediation.
  • Deploy Subresource Integrity (SRI): Ensure all third-party script tags include SRI hashes so that tampered scripts fail to load. This is a low-effort, high-impact control that would have blocked the Plerdy vector.
  • Mobile threat defense: If your organization supports BYOD or has staff traveling to high-risk regions, deploy a mobile threat defense solution that can detect malicious redirects and payload delivery on iOS and Android. Standard MDM alone is insufficient.
  • Network-level blocking: Block known malicious domains associated with this campaign at DNS and proxy layers. Sekoia's report should contain IOCs — integrate them into your SIEM and edge controls immediately.

Strategic Actions

  • Threat-informed travel security: Brief traveling executives and diplomatic-facing staff on watering hole risks before deployments. Consider issuing clean travel devices with restricted browsing profiles.
  • Content Security Policy (CSP): Implement strict CSP headers on all organizational websites to prevent unauthorized script execution and reduce the blast radius of any single compromise.
  • Supply-chain risk management: Treat every third-party web script as a potential attack surface. Maintain an inventory, enforce SRI, and periodically audit script sources for anomalous behavior.
  • Hunt for post-exploitation: If any staff devices may have visited compromised sites, hunt for APT29 post-exploitation tradecraft — including OAuth token abuse, MFA fatigue attacks, and lateral movement via cloud identity — which are hallmarks of this group's post-compromise activity.

This campaign is a reminder that APT29 continues to evolve its access methodologies while maintaining its strategic focus. Defenders who treat mobile devices and third-party web scripts as peripheral concerns are leaving open the exact doors this group is walking through.