The attackers utilized three primary infection vectors to compromise devices. These included direct JavaScript injection into legitimate web traffic, the use of proxy domains like america250.holiday, and a supply-chain attack against a Ukrainian web analytics service. The injected code profiled the visitor's browser and device to facilitate the deployment of zero-click exploit chains.
Researchers from Sekoia identified three distinct zero-click exploit chains used in the campaign. One of these is DarkSword, an iOS exploit kit previously linked to the Turkish surveillance vendor PARS Defense. The other two exploit chains remain unnamed. All vulnerabilities exploited in these attacks were n-days, meaning they only affected devices running outdated versions of iOS or Android.
The campaign targeted high-profile entities by impersonating websites such as america250.org and the Raffles London at The OWO hotel. The latter is located near sensitive UK government sites, including the Ministry of Defence and 10 Downing Street. Additionally, attackers compromised a Ukrainian gas production company to distribute malicious payloads.
Sekoia attributes the campaign to the Kremlin, citing the specific target profiles and operational similarities to previous activities by the group known as APT29. The researchers suggest that the attackers likely chose these specific websites to leverage national events and the presence of diplomatic delegations for spear-phishing campaigns.
