Russia's Foreign Intelligence Service, operating under the APT29 designation, has expanded its watering-hole campaigns to target mobile devices running iOS and Android. The campaign, documented by Sekoia in October 2026, represents a significant operational shift: APT29 is now using n-day exploit chains sourced from or modeled on commercial spyware vendors, a technique previously associated with Tier 1 mobile surveillance operators such as NSO Group and Intellexa.
The campaign
Sekoia researchers identified compromised websites serving exploit chains that fingerprinted visitor devices and delivered different payloads depending on the target's platform. iOS visitors received an exploit targeting a recently patched WebKit vulnerability. Android visitors received a credential harvesting payload using social engineering overlays. The compromised sites targeted by APT29 were high-value news and government information portals whose audience likely includes diplomatic staff, journalists, and policy researchers.
What makes this different from previous APT29 activity
Earlier APT29 mobile operations relied primarily on spear-phishing to deliver malicious links or apps. The shift to watering holes represents a move up the operational sophistication curve: a compromised site reaches anyone who visits it, not just targets who click a specific email. The use of n-day exploits (vulnerabilities with patches available that many targets have not yet applied) reflects both the difficulty of obtaining zero-days and the sustained effectiveness of n-days against mobile devices, where update rates lag significantly behind desktop.
The commercial spyware connection
Sekoia's analysis found that the exploit chain bore structural similarities to techniques attributed to commercial spyware vendors operating in the European market. This aligns with a broader trend: state intelligence services increasingly source or reverse-engineer capabilities from the commercial surveillance industry rather than developing them entirely in-house. The technique borrowing cuts both ways: when a commercial vendor's exploit is exposed by researchers, those same analysis techniques give APT29 and others a template to adapt.
iOS and Android: different attack surfaces
On iOS, the exploit targeted CVE-2024-27834, a WebKit remote code execution vulnerability patched in Safari. Despite the patch being available for over a year, a meaningful fraction of government and enterprise devices had not applied it, particularly in regions where centralized mobile device management is not standard. On Android, the payload was less technically sophisticated, relying on credential harvesting overlays rather than a code execution chain, reflecting the platform's greater fragmentation and the attacker's choice to invest exploit complexity where it delivers the most value.
Defender takeaways
- Enforce mobile device updates via MDM: n-day exploit chains succeed because targets do not patch. MDM policies should enforce minimum OS versions and flag devices that fall behind. The gap between patch availability and patch application is where APT29 operates.
- Treat CVE-2024-27834 as an active risk: Apple added this vulnerability to the CISA KEV catalog in November 2026 with a remediation deadline. Any iOS device running Safari below the patched version is a live attack surface for this campaign.
- Monitor for watering hole indicators: browser telemetry and DNS logs showing access to compromised sites can surface exposure before compromise completes. Threat intelligence feeds that track APT29 infrastructure are more valuable here than generic IOC lists.
Why this matters
APT29 borrowing from commercial spyware vendors changes the threat model for organizations that assumed nation-state mobile attacks required zero-days they could not defend against. N-day exploit chains are addressable through consistent patching. The challenge is organizational: getting every device on the update schedule, enforcing it via policy, and monitoring for exceptions. The technical fix is straightforward. The governance problem is the hard part.
Gigia Tsiklauri is a Security Architect and founder of Infosec.ge. Get in touch if you are assessing mobile security posture or developing a defensive strategy against nation-state actors.