APT29 Poisons Plerdy Analytics CDN to Deliver Mobile Exploit Chains Against Unpatched iPhones and Android Devices

A watering hole attack compromises a site the target regularly visits rather than attacking the target directly. APT29's November 2026 campaign operated on three simultaneous delivery channels, each serving the same UltimateFingerprinter JavaScript payload.

Supply chain channel (Plerdy CDN): APT29 obtained credentials sufficient to push malicious JavaScript through Plerdy's CDN infrastructure. Every website with a standard Plerdy analytics snippet began serving the backdoored script automatically, without any action from the website operator. This channel gave APT29 broad, passive reach across Plerdy's customer base for approximately one week in mid-October.

Direct injection channel: On a subset of target-relevant websites, APT29 injected the UltimateFingerprinter script directly into page source, independent of the Plerdy channel. This provided coverage even for sites that do not use Plerdy.

AiTM infrastructure channel: Adversary-in-the-middle proxy domains impersonated legitimate resources, enabling script delivery to visitors even when navigating through HTTPS connections that the group could observe through its proxy infrastructure.

Once loaded, UltimateFingerprinter collects platform data, browser version, OS version, installed fonts, and canvas fingerprint before transmitting to APT29's staging infrastructure. The staging layer evaluates the fingerprint against a targeting ruleset, then delivers the platform-specific exploit chain or returns a benign stub for non-target profiles.

On iOS, CVE-2026-3910 provides initial in-browser code execution. The chain then escalates through additional bugs to achieve sandbox escape and persistent access to the device's credential store and cookie database. On Android devices with Qualcomm silicon, CVE-2025-27038, a heap overflow in the Adreno GPU kernel driver, enables sandbox escape from the browser's restricted context.

Blast radius: CVE-2026-3910 and CVE-2025-27038 require no user authentication, no file download, and no click — only an unpatched device visiting any website serving the compromised Plerdy script. Successful exploitation gives APT29 silent access to all browser session cookies, stored Wi-Fi credentials, and the device's full credential database with no interaction beyond the page load.

Devices running fully patched iOS or Android are not vulnerable to this specific chain. The targeting evidence clusters around Ukraine-focused sites, suggesting primary intelligence collection objectives, though the watering hole approach means any visitor to a compromised site was profiled and potentially exploited.

APT29's Poisoned Source campaign uses a TTP stack that is consistent with the group's established tradecraft, with the mobile-focused delivery representing a tactical evolution from their more commonly reported Windows-focused operations.

SOC detection priority: T1189 and T1195.002 are the highest-value detection opportunities for defenders. Web proxy logs that capture unusual JavaScript payloads from known analytics CDN endpoints, particularly those with anomalous size or content that includes AngularJS libraries alongside minified obfuscation layers, are the clearest pre-exploitation signal available.

T1082 (fingerprinting beacon) generates a distinctive outbound HTTP request with specific header combinations and body structure. Organizations with full-packet capture on their web proxy can write detection rules against the specific fingerprinting request format documented in Sekoia's Poisoned Source report.

These rules target the two highest-confidence detection opportunities: anomalous analytics CDN script delivery and post-exploitation cookie database access patterns on mobile endpoints managed through enterprise MDM. Both carry experimental status; validate against your environment's log format before enabling automatic blocking.

The highest-value detection opportunity for most organizations is in web proxy logs during the mid-October 2026 compromise window. Standard Plerdy analytics scripts are measured in kilobytes. Any proxy log entry from plerdy.com in that window warrants investigation — use the exposure filter in the IR guidance block below to scope and triage.

For organizations with endpoint detection on managed mobile devices, look for browser processes initiating file access to cookie databases or credential stores outside of normal browser engine operations. APT29's post-exploitation module directly accesses the iOS cookie store and the Android /proc/net/arp interface as early steps in its credential harvesting sequence.

Browser-side indicators: Organizations running custom browser extensions or Content Security Policy (CSP) reporting endpoints may have CSP violation reports from that period if the injected script attempted to load resources from non-whitelisted origins. Review CSP violation logs from mid-October for any unexpected script-src violations tied to analytics CDN loads.

Defenders can close the exposure from this campaign by patching mobile operating systems and auditing any websites that loaded Plerdy analytics during the compromise window. Organizations with evidence of exposure should treat affected devices as potentially compromised and initiate their mobile device incident response procedures.

Plerdy is a legitimate web analytics and conversion optimization platform used by website owners to record user sessions, track heatmaps, and monitor conversion funnels. Its standard integration method is a small JavaScript snippet loaded from Plerdy's CDN, which means every site using Plerdy automatically loaded APT29's modified script during the compromise window.

The compromise ran for approximately one week before discovery and remediation. During this window, APT29 had passive, automatic delivery capability to every unpatched mobile visitor across Plerdy's entire customer base. This mirrors the structure of the Brevo supply chain attack in which attackers abused a trusted SaaS platform as a delivery mechanism.

What organizations using Plerdy should check:

Review your Content Security Policy logs and web server access logs for the mid-October 2026 window. Look for any unusual requests to Plerdy CDN endpoints with anomalous response sizes. Standard analytics scripts are measured in kilobytes; the compromise window payload was orders of magnitude larger.

Compare the hash of any cached or locally stored Plerdy script files from that period against Plerdy's published clean hashes. Organizations with endpoint detection on managed devices should check for browser-initiated network connections to unfamiliar IP ranges immediately following visits to Plerdy-enabled sites during the compromise window.

Plerdy has since remediated the CDN compromise and pushed clean scripts to all distribution endpoints. Organizations can re-enable the integration after verifying the current script integrity. Any website that loaded Plerdy during the compromise window should be treated as a potential watering hole and disclosed to affected users if warranted by your incident response policy.

APT29 is assessed with high confidence to be an offensive cyber unit of Russia's SVR foreign intelligence service. The group has operated continuously since at least 2008, targeting diplomatic, government, defense, and technology organizations across NATO member states and neighboring countries, with persistent focus on Ukraine following the February 2022 invasion.

Who is APT29? APT29 is a Russian state-sponsored advanced persistent threat group operating under the direction of Russia's SVR foreign intelligence service. The group is responsible for the 2020 SolarWinds supply chain compromise, the 2021 Microsoft Exchange server attacks against research institutions, and persistent targeting of EU and NATO foreign ministries. It is tracked across industry under multiple names including Midnight Blizzard (Microsoft), Cozy Bear (CrowdStrike), and The Dukes (F-Secure).

Current targeting priorities: The November 2026 campaign victim profile centers on Ukraine-linked organizations and the websites they visit regularly, consistent with SVR's strategic intelligence collection mandate. However, the watering hole delivery method provides coverage against any visitor to a compromised site, including government officials, defense contractors, journalists, and researchers in Western countries who happen to visit targeted websites.

Has APT29 been sanctioned? The US Department of the Treasury sanctioned multiple SVR officers linked to APT29 in April 2021 following the SolarWinds compromise attribution. The European Union issued sanctions against named SVR officers in October 2020. Despite sanctions, the group remains operational.

Notable campaigns:

The credential and cookie theft focus of this campaign resembles the Fortibleed credential harvesting campaign, though APT29 targets mobile device credential stores rather than perimeter network appliances.