APT29 Hijacks Plerdy Analytics Script in Large-Scale Mobile Exploit Campaign

En bref

• Sekoia attributes the campaign to APT29, a Russia-linked threat group.
• Attackers took over Plerdy SEO Tracker JavaScript embedded on breached sites.
• Fake domains and browser/device profiling preceded exploit delivery.
• iOS and Android visitors were targeted; no CVE was cited.

Researchers at Sekoia have linked a broad watering-hole and software supply-chain operation to APT29, a threat group associated with Russia. The campaign centered on Plerdy SEO Tracker, an analytics product whose JavaScript was taken over and placed into sites that had already been breached. Instead of only measuring traffic, the altered script gathered attributes from visitors' browsers and devices, helping operators decide who to target and when to serve malicious code.

The operation used fraudulent domains as part of its infrastructure, according to the Sekoia findings. After profiling a visitor, the attackers could deliver exploits aimed at mobile platforms, specifically Apple iOS and Google Android. Because the malicious code arrived through a trusted analytics component embedded across many sites, the activity combined supply-chain risk with watering-hole tactics and reached a large audience.

For New Brunswick K-12 and government web properties, the key concern is third-party script trust. Any site that embeds analytics, tag managers, or similar vendors inherits risk from those dependencies. The reported campaign did not name education targets, and no CVE was assigned, so defenders should focus on exposure assessment and vendor assurance rather than patching a single flaw.

Watch for unexpected changes to analytics script sources, new or lookalike domains in page requests, and mobile users being redirected or prompted to install updates. Review content security policy, subresource integrity where feasible, and vendor security notifications. Sekoia's attribution raises the priority because APT29 is a known state-linked actor, but organizations should validate indicators before blocking.

À faire maintenant

1. Inventory every third-party analytics and tag-management script on public web properties, prioritizing any use of Plerdy SEO Tracker.
2. Disable or remove the affected Plerdy script until the vendor confirms its integrity, and restrict script sources through a tightened content security policy.
3. Search proxy, DNS, and web logs for requests to lookalike or fraudulent domains tied to the campaign, then block confirmed indicators.
4. Apply subresource integrity to external scripts where supported and alert on unauthorized changes to script sources or tags.
5. Review mobile device management and endpoint telemetry for iOS and Android users showing redirects, exploit prompts, or unusual browser behavior.
6. Preserve relevant logs and page source evidence, notify the vendor and security team, and compare findings against Sekoia's published indicators.
7. Require a security review of analytics suppliers and communicate interim restrictions to website owners and content managers.

Source originale

The Hacker News