# Russian Hackers Deploy Exploit Chains Against Mobile Devices Through Compromised Websites

*Published November 6, 2026*
*Source: [https://www.securityweek.com/russia-linked-hackers-hit-ios-android-devices-with-exploit-chains-via-watering-holes/](https://www.securityweek.com/russia-linked-hackers-hit-ios-android-devices-with-exploit-chains-via-watering-holes/)*

## Executive Summary

Midnight Blizzard, a Russian state-sponsored hacking group, has targeted iOS and Android devices using zero-click exploit chains via compromised websites. This campaign highlights the ongoing threat of sophisticated cyberattacks against high-profile targets in Europe and the United States.

*This is a Premium edition: its actionable insights are available to sec-news.ai Premium members —*
*[read the story](https://www.sec-news.ai/news/russian-hackers-deploy-exploit-chains-against-mobile-devices-through-compromised-websites) or [see plans](https://www.sec-news.ai/pricing).*

## Article

A Russian state-sponsored hacking group, known as Midnight Blizzard, has been implicated in a series of sophisticated cyberattacks targeting iOS and Android devices. According to cybersecurity firm Sekoia, the attacks utilized zero-click exploit chains via watering hole campaigns, compromising users in Europe and the United States. Midnight Blizzard, also referred to as APT29 or Cozy Bear, is believed to be affiliated with the Russian Foreign Intelligence Service. The group has a history of targeting government organizations, diplomats, IT service providers, and NGOs for intelligence gathering purposes.

Sekoia uncovered that the attackers compromised or cloned several high-profile websites, including those of a Ukrainian gas production company, a major industry trade association, and a far-right European political party. They injected malicious JavaScript code designed to fingerprint visitors by collecting browser and device configuration data. The data was then sent in JSON format before delivering the exploit.

The group used an adversary-in-the-middle setup, registering lookalike domains that acted as reverse proxies for legitimate sites. This allowed them to inject malicious code into copies of sites such as america250.org and the Raffles London hotel website. These actions may have been aimed at targeting diplomatic delegations and high-profile guests, including Ukrainian President Volodymyr Zelensky.

In addition, Midnight Blizzard targeted a Ukrainian web analytics service called Plerdy, which led to hundreds of websites being exposed to the exploit kit. The campaign involved three exploit chains: two targeting iOS devices and one targeting Android. All chains exploited previously patched vulnerabilities, with the iOS chains relying heavily on the DarkSword exploit kit.

CVE-2024-27834, one of the vulnerabilities used, was patched in May 2024 and added to CISA's Known Exploited Vulnerabilities catalog. The Android chain targeted a Chrome vulnerability and a Qualcomm bug, delivering a payload named AndroSnitch to steal sensitive data. Sekoia warns that the use of packaged n-day exploit chains is reducing the cost and complexity of advanced mobile exploitation, potentially leading to more frequent use among state-sponsored groups.