Sekoia's Threat Detection & Research team said on 4 November 2026 that in mid-October it uncovered a large-scale watering-hole campaign that compromised or cloned high-profile websites in the US, Ukraine, the Czech Republic and Bulgaria, and assesses with moderate to high confidence that it was conducted by APT29, which it describes as a Russian-nexus intrusion set widely attributed to Russia's Foreign Intelligence Service (SVR).

Sekoia says the attackers used three routes to the same profiling script: JavaScript injected into legitimate sites (including a Ukrainian gas production company, a US chemical-industry trade association and a Bulgarian military-related site), reverse-proxy lookalike domains such as america250[.]holiday and theowo[.]club, and the Plerdy SEO tracker (a.plerdy[.]com), which it says was compromised between 27 August and 3 September 2026 and is loaded by thousands of mostly Ukrainian websites. The delivery server then served platform-specific exploit chains without user interaction: CVE-2025-43529 with CVE-2024-27834 against iOS 16.7 to steal cookies; the DarkSword chain (CVE-2025-43529, CVE-2026-20700, CVE-2025-14174, CVE-2025-43510, CVE-2025-43520) against iOS 18.5 to harvest data including WhatsApp and Telegram databases, Keychain passwords and tokens, and Wi-Fi keys; and CVE-2026-3910 with CVE-2025-27038 against Chrome for Android 139 to 145 (excluding 143) to steal Chrome data and Wi-Fi passwords.

Sekoia says each flaw was fixed by the vendor before the campaign began, the chains do not work against fully updated devices, the payloads do not establish persistence, and it is working with the CERTs of affected countries. (source: Sekoia) CISA added CVE-2024-27834 to its Known Exploited Vulnerabilities catalog on 4 November 2026. (source: CISA KEV)