Hackers potentially linked to the Kremlin exploited previously patched iOS and Android vulnerabilities to try to hack visitors to several websites, including one celebrating the 250th anniversary of American independence, researchers said Wednesday.
The attackers, whom researchers rated with “moderate to high confidence” as being part of Russia’s foreign intelligence services, targeted other sites, many of which had ties to that country’s ongoing war against Ukraine. The attacks began when iPhone or Android users visited one of hundreds of different sites. JavaScript injected into the traffic then profiled the device. The final payloads, tailored to the type of platform visited, attempted to steal browser cookies and, in some cases, Wi-Fi passwords and all data from mobile devices.
Wield the Dark Sword
One of the spoofed sites was america250.org, owned by a nonpartisan group of lawmakers, business executives and at least one former member of the Trump administration. The attackers registered america250(.)holiday and used it as a reverse proxy for america250.org. The impostor website delivered content from the real site that added malicious JavaScript to it.
“We believe that the intrusion team may have deliberately selected this website due to its association with a high-profile national celebration, potentially leveraging the event as a pretext for invitational spear phishing campaigns,” researchers at security firm Sekoia said.
A second website, theowo(.)club, represented the Raffles of London OWO website, a luxury hotel physically close to some of the United Kingdom’s most sensitive government institutions, including the Ministry of Defense and 10 Downing Street, the official residence and office of the British Prime Minister. Open sources indicate that Ukrainian President Volodymyr Zelenskyy stayed there during a visit on October 14.
Gn tech
