Hackers believed to be connected to the Kremlin have exploited previously patched vulnerabilities in iOS and Android systems to target visitors of multiple websites, including one commemorating the 250th anniversary of American independence, according to findings released by cybersecurity researchers on Wednesday.
The attackers, assessed with “moderate to high confidence” to be from Russia’s Foreign Intelligence Service, have launched an operation that affects various websites, many of which relate to Russia’s ongoing conflict with Ukraine. The cyber assault initiates when users of iPhones or Android devices access one of potentially hundreds of compromised sites. Once a user is on one of these pages, malicious JavaScript is injected, allowing attackers to gather information about the device. The ultimately delivered payloads are crafted to exploit the specific characteristics of the platform being used, aiming to extract sensitive information such as browser cookies and, in certain cases, Wi-Fi passwords along with comprehensive mobile device data.
Among the sites that have been spoofed is america250.org, which is associated with a coalition of lawmakers, business figures, and at least one former official from the Trump administration. The attackers cleverly registered a look-alike domain, america250[.]holiday, using it as a reverse proxy to the legitimate site. This counterfeit domain served content from america250.org while secretly embedding harmful JavaScript.
Researchers at the cybersecurity firm Sekoia suggest that the attackers may have intentionally chosen this website due to its link to a significant national celebration, potentially using the event as a vehicle for focused spear-phishing campaigns aimed at drawing in unwitting victims.
Another targeted site, theowo[.]club, served as a proxy for Raffles of London OWO, a luxury hotel situated near key UK governmental landmarks, including the Ministry of Defence and the official residence of the British Prime Minister at 10 Downing Street. Open source reports indicate that the hotel hosted Ukrainian President Volodymyr Zelenskyy during an official visit in mid-October.
From a technical perspective, this campaign illustrates the use of several tactics described in the MITRE ATT&CK framework. Initial access was primarily gained through social engineering techniques, with the attackers exploiting established trust in legitimate sites to execute their malware. Persistence techniques may also be indicated, as the use of a reverse proxy could facilitate ongoing control of the compromised sites. Furthermore, the dynamic nature of the payload delivery suggests potential privilege escalation, allowing attackers to gain higher access privileges on the targeted devices.
As cyber threats continue to evolve and become more sophisticated, it is paramount for business owners to remain vigilant and informed about these incidents. Understanding how attackers operate and the tactics they employ is vital for fortifying defenses against such breaches.