Sekoia Links Broad Mobile Campaign to APT29/SVR Using Hijacked Sites and Analytics

Key points

• Sekoia ties a broad mobile campaign to APT29, an SVR-associated group also tracked as Cozy Bear, Nobelium and Midnight Blizzard.
• The operation uses hijacked websites and a compromised analytics service to target iOS and Android users.
• No CVE is associated with the activity, so patching alone will not address the exposure.
• K-12 sites and third-party scripts are relevant risk surfaces for staff, students and families on mobile devices.

The research vendor Sekoia has tied a sprawling mobile-oriented campaign to APT29, an intrusion set associated with Russia’s SVR and also tracked as Cozy Bear, Nobelium, and Midnight Blizzard. The finding places the activity in a well-known espionage nexus rather than in ordinary criminal web fraud.

The tradecraft described by Sekoia does not hinge on a CVE. Instead, the group hijacks websites and compromises an analytics service, then uses those footholds to steer mobile visitors toward malicious content. This is a watering-hole approach carried out at broad scale, with targeting aimed at people using iOS and Android devices.

For a K-12 agency, the exposed population is anyone who visits district, school, or program sites from a phone, including staff, students, and families. A compromised analytics component is especially relevant because such scripts are often embedded across many pages and trusted by default.

Because no CVE is linked to this activity, vulnerability-management queues will not surface it. The risk sits in web supply chains, third-party script permissions, and site integrity. Sekoia’s attribution also matters for context: SVR-linked actors have repeatedly blended credential theft, web compromise, and stealthy access to reach priority targets.

Watch for unexpected mobile redirects, altered analytics tags, unauthorized changes to public-facing sites, and reports from users who land on unusual pages after visiting a legitimate school site. Treat analytics vendors and other embedded scripts as privileged dependencies, and review whether each one truly needs to run on every page.

What to do now

1. Inventory every third-party script and analytics tag on public-facing district and school sites, then remove or tightly restrict any that are not clearly necessary.
2. Monitor web servers and CMS content for unauthorized file changes, new redirects, and injected scripts, with alerts for modifications to pages that serve mobile visitors.
3. Require MFA and least-privilege access for CMS, web hosting, and analytics accounts, and review vendor access paths into district sites.
4. Apply DNS and web proxy filtering, and hunt for redirects from district sites to unexpected mobile landing pages or credential prompts.
5. Brief staff, students, and families to report unusual mobile redirects or login prompts encountered after visiting a legitimate school site.
6. Once Sekoia publishes indicators, block known malicious domains and URLs and search web and DNS logs for prior contact.

Original source

Security Affairs