APT29 Targets Mobile Users via Watering Hole Attacks

The Russian state-sponsored threat group APT29 is conducting watering hole attacks designed to target thousands of mobile users. The group is compromising legitimate websites to fingerprint visitors and identify high-value targets for information harvesting.

Targeted Fingerprinting and Data Harvesting

The attack sequence begins with the compromise of trusted websites. Once a site is under the group’s control, the attackers deploy scripts to fingerprint the devices of visiting users. This fingerprinting process gathers unique technical identifiers related to the user’s mobile device and browser configuration.

Following the fingerprinting stage, the group filters the collected data to isolate individuals deemed “interesting.” By focusing on specific profiles, APT29 can move to harvest information from high-value targets while remaining stealthy and avoiding the detection associated with broader, less precise campaigns.

This methodology suggests a highly focused espionage objective. Rather than attempting mass infection, the group uses the compromised websites as a reconnaissance tool to distinguish between general traffic and specific individuals of interest.

APT29, also known as Cozy Bear, is a well-documented advanced persistent threat (APT) group widely believed to be affiliated with Russian intelligence services. The group has a long history of conducting targeted cyber espionage operations against government, diplomatic, and security organisations globally.