APT29-Linked Hackers Hijack Web Analytics Script to Deliver iOS and Android Exploits
APT29, the Russian state-sponsored threat actor also known as Cozy Bear, has orchestrated a sophisticated watering hole attack campaign by compromising the Ukrainian web analytics service Plerdy SEO Tracker. The attackers injected malicious JavaScript into legitimate websites using this service, targeting both iOS and Android users with device fingerprinting capabilities designed to identify and exploit vulnerable mobile platforms. This supply chain compromise demonstrates the evolving tactics of advanced persistent threat groups in leveraging trusted third-party services to reach high-value targets at scale.
Introduction
The cybersecurity landscape has witnessed another calculated move by APT29, one of Russia’s most sophisticated cyber espionage groups. This time, the threat actor has executed a watering hole campaign with a modern twist—compromising a web analytics platform to inject malicious code across multiple websites simultaneously. Unlike traditional watering hole attacks that require individually compromising each target website, this supply chain approach allowed APT29 to cast a significantly wider net by exploiting a single point of failure: the Plerdy SEO Tracker analytics service.
The campaign specifically targets mobile users on iOS and Android platforms, employing advanced fingerprinting techniques to collect detailed device and browser attributes. This information serves as reconnaissance data to identify targets worthy of exploitation attempts. The operation underscores a critical vulnerability in modern web infrastructure—the implicit trust placed in third-party JavaScript libraries and analytics services that execute with full privileges on thousands of websites.
Background & Context
APT29, attributed to Russia’s Foreign Intelligence Service (SVR), has maintained a prominent position among nation-state threat actors since at least 2008. The group gained global notoriety for its involvement in the 2016 Democratic National Committee breach and the 2020 SolarWinds supply chain attack. Their operations consistently demonstrate advanced tradecraft, operational security, and a focus on intelligence collection targeting government agencies, think tanks, and research institutions.
Watering hole attacks represent a strategic approach where adversaries compromise websites frequented by their intended targets rather than attacking those targets directly. This technique proves particularly effective against organizations with robust perimeter defenses, as users willingly visit trusted sites that have been weaponized without their knowledge.
Plerdy SEO Tracker is a Ukrainian web analytics and conversion optimization platform used by numerous commercial and organizational websites. By compromising such a service, APT29 gained the ability to inject malicious code into every website utilizing the Plerdy tracking script—a textbook supply chain attack that multiplies the attacker’s reach exponentially.
Technical Breakdown
The attack chain begins with the compromise of Plerdy’s infrastructure, allowing APT29 operatives to modify the legitimate analytics JavaScript served to client websites. The injected malicious code executes in visitors’ browsers with the same trust level as the original analytics functionality.
The malicious JavaScript performs comprehensive device fingerprinting, collecting attributes including:
// Example of typical fingerprinting data collection
{
"userAgent": navigator.userAgent,
"platform": navigator.platform,
"language": navigator.language,
"screenResolution": ${screen.width}x${screen.height},
"colorDepth": screen.colorDepth,
"timezone": Intl.DateTimeFormat().resolvedOptions().timeZone,
"plugins": navigator.plugins,
"canvasFingerprint": generateCanvasHash(),
"webglVendor": getWebGLVendor(),
"touchSupport": navigator.maxTouchPoints
}For mobile devices specifically, the script harvests iOS and Android-specific browser properties to determine device models, operating system versions, and browser capabilities. This granular profiling enables the attackers to identify devices running vulnerable software versions suitable for exploitation.
The collected data exfiltrates to attacker-controlled infrastructure, where backend systems likely perform automated analysis to identify high-value targets meeting specific criteria. Once promising targets are identified, the infrastructure can dynamically serve actual exploits rather than just fingerprinting code.
The campaign’s focus on mobile platforms suggests APT29 either possesses zero-day exploits for iOS and Android or seeks to identify devices running outdated versions vulnerable to known exploits. Mobile devices have become primary communication tools for government officials and executives, making them attractive espionage targets.
Impact & Risk Assessment
The impact of this campaign extends across multiple dimensions. First, any organization whose website integrated Plerdy analytics inadvertently became a distribution point for malicious code. These organizations face reputational damage and potential liability concerns, even though they were victims rather than perpetrators.
Second, visitors to affected websites—particularly those using mobile devices—face direct security risks. While initial reports indicate the campaign focused on fingerprinting, the infrastructure could easily pivot to delivering actual exploits once suitable targets are identified. Government personnel, diplomats, defense contractors, and policy researchers who visited compromised sites represent the most likely intended targets.
Third, the incident highlights systemic risks in the web ecosystem’s heavy reliance on third-party JavaScript. Modern websites routinely load code from dozens of external domains, creating numerous supply chain attack opportunities. Content Security Policy (CSP) implementations remain inconsistent, and many organizations lack visibility into what third-party scripts actually execute on their sites.
The risk severity rates as HIGH for organizations in sectors typically targeted by APT29, including:
- Government agencies and defense contractors
- Think tanks and policy research organizations
- Telecommunications and technology companies
- Energy sector entities
- Healthcare and pharmaceutical organizations
Vendor Response
Plerdy has acknowledged the compromise and taken immediate action to remediate the security incident. The company has rotated credentials, conducted forensic analysis of affected infrastructure, and published updated versions of their tracking script. Plerdy has also been cooperating with law enforcement and cybersecurity researchers investigating the incident.
The company issued a security advisory recommending that all customers verify they are running the latest version of the Plerdy tracking code and review their web server logs for suspicious activity during the compromise window. Specific dates of the active compromise period have been communicated to affected customers under coordinated disclosure practices.
Ukrainian cybersecurity authorities have also engaged with the investigation, given the geopolitical context of a Russian state-sponsored group targeting Ukrainian infrastructure. This incident adds to the ongoing cyber conflict between Russia and Ukraine that has intensified significantly since 2022.
Mitigations & Workarounds
Organizations using Plerdy analytics should take immediate action:
Immediate Actions:
- Update to the latest Plerdy tracking script version provided by the vendor
- Review website access logs for the compromise period to identify potentially affected visitors
- Temporarily remove Plerdy tracking code until verification of clean implementation
Code Verification:
sha256sum /path/to/plerdy-script.js
# Compare against vendor-provided hash valuesFor General Protection:
- Implement Subresource Integrity (SRI) for all third-party JavaScript includes
- Deploy Content Security Policy headers restricting script sources
- Use browser isolation technologies for high-risk users
- Conduct regular audits of third-party JavaScript dependencies
Detection & Monitoring
Security teams should implement detection measures for similar supply chain compromises:
Network-Level Detection:
# Monitor for unexpected domains in analytics script connections
grep "plerdy" /var/log/nginx/access.log | \
awk '{print $1}' | sort | uniq -c | sort -rnCSP Reporting:
Implement CSP report-only mode to identify unexpected JavaScript behavior:
Content-Security-Policy-Report-Only: script-src 'self' https://trusted-cdn.com; report-uri /csp-reportSIEM Correlation Rules:
- Alert on multiple simultaneous connections to analytics providers from internal infrastructure
- Flag JavaScript modifications to analytics vendor scripts
- Monitor for unusual data exfiltration patterns from web applications
Endpoint Monitoring:
Mobile device management (MDM) solutions should track:
- Installation of unexpected profiles or applications
- Unusual network connections from mobile devices
- Jailbreak or root detection indicators
Best Practices
Organizations should adopt comprehensive third-party risk management practices:
Supply Chain Security:
- Maintain inventory of all third-party JavaScript dependencies
- Implement automated monitoring for changes to external scripts
- Use Subresource Integrity (SRI) attributes wherever possible
- Consider self-hosting critical third-party libraries after security review
Vendor Risk Management:
- Conduct security assessments of analytics and tracking providers
- Require vendors to maintain SOC 2 Type II or equivalent certifications
- Establish incident notification requirements in vendor contracts
- Implement vendor security scorecards with continuous monitoring
Defense in Depth:
- Deploy multiple layers of browser security controls
- Implement network segmentation to limit blast radius
- Use threat intelligence feeds to identify emerging campaigns
- Conduct regular tabletop exercises for supply chain compromise scenarios
Mobile Device Security:
- Enforce mobile device management with mandatory security updates
- Implement certificate pinning for sensitive mobile applications
- Use mobile threat defense solutions for high-risk users
- Educate users on recognizing potentially compromised websites
Key Takeaways
- APT29 continues evolving tactics, leveraging supply chain attacks against analytics platforms to reach targets at scale
- The compromise of Plerdy SEO Tracker demonstrates the systemic risk posed by third-party JavaScript dependencies
- Mobile platforms represent increasingly attractive targets for state-sponsored espionage groups
- Organizations must implement comprehensive third-party risk management and monitoring
- Subresource Integrity, Content Security Policy, and vendor security assessments form critical defensive layers
- The geopolitical context of a Russian APT targeting Ukrainian infrastructure reflects ongoing cyber conflict dynamics
- Detection requires multi-layered monitoring spanning network, application, and endpoint telemetry
References
- CISA Alert on APT29 Tactics, Techniques, and Procedures
- Plerdy Security Advisory and Incident Response Documentation
- MITRE ATT&CK Framework: Supply Chain Compromise (T1195)
- Web Application Security Consortium: Subresource Integrity Best Practices
- National Security Agency: Mitigating Supply Chain Attacks Guidance
Stay updated at https://cydhaal.com — Your Daily Dose of Cyber Intelligence.
📧 Subscribe to our newsletter at https://cydhaal.com/newsletter/
