Hackers possibly connected to the Kremlin exploited previously patched iOS and Android vulnerabilities in an attempt to target visitors of multiple websites, including a portal celebrating the 250th anniversary of American independence, researchers reported Wednesday.
Targeting High-Profile Sites
The attackers, assessed by researchers with moderate to high confidence to be part of Russia’s Foreign Intelligence Service, also targeted other websites, many connected to that country’s ongoing war against Ukraine. The attacks initiated when users of iPhones or Android devices visited one of potentially hundreds of different websites, where injected JavaScript profiled the targeted device.
Tailored final payloads corresponding to the operating platform attempted to steal browser cookies as well as Wi-Fi passwords and full mobile device data in specific cases. One of the impersonated websites was america250.org, which belongs to a non-partisan group comprising lawmakers, business executives, and at least one former official from the Trump administration. The attackers registered america250[.]holiday to function as a reverse proxy to america250.org, delivering content from the genuine site while inserting malicious JavaScript.
Researchers from the security firm Sekoia stated that the intrusion set may have deliberately selected this website due to its association with a high-profile national celebration, potentially leveraging the event as a pretext for invitation-themed spear-phishing campaigns. A second website, theowo[.]club, proxied Raffles of London OWO, a luxury hotel located physically close to sensitive British government institutions such as the Ministry of Defence and 10 Downing Street, the official office and residence of the British Prime Minister. Open source reporting notes that Ukrainian President Volodymyr Zelenskyy stayed at the hotel during a visit on October 14.
