Hackers possibly linked to the Kremlin exploited previously patched iOS and Android flaws in an attempt to hack visitors to several websites, including one celebrating the 250th anniversary of American independence, researchers said Wednesday.
The attackers, who the researchers rated with “moderate to high confidence,” were part of Russia’s foreign intelligence service, targeting other sites, many with links to that country’s ongoing war against Ukraine. The attacks began when iPhone or Android users visited one of potentially hundreds of different sites. Injecting JavaScript into the traffic then profiled the device. The latest payloads, tailored to the type of platform visited, tried to steal browser cookies and, in some cases, Wi-Fi passwords and full mobile device data.
Choose DarkSword
One of the impersonated sites was america250.org, owned by a non-partisan group of lawmakers, business leaders, and at least one former member of the Trump administration. The attacker registered america250[.]Vacation and use it as a reverse proxy to america250.org. The Imagination website provided content from the real, which added malicious JavaScript to it.
“We assess that the intrusion set deliberately chose this website because of its association with a high-profile national celebration, potentially leveraging the event as a pretext for invitation-themed spear-phishing campaigns,” said researchers from security firm Sekoia.
A second website, theowo[.]club, proxied the website Raffles of London OWO, a luxury hotel physically close to some of the UK’s most sensitive government institutions, including the Ministry of Defense and 10 Downing Street, the official residence and office of the British Prime Minister. Open source reporting indicates that Ukrainian President Volodymyr Zelenskyy stayed there during a visit on October 14.