CuraSec

tag: Watering-Hole · 2 items

Learn Russian hackers use n-day zero-click exploits in mobile watering hole campaign
2026-11-04 · BleepingComputer · source ↗ #watering-hole#mobile-security#zero-click
  • Engineer — Skip
  • SOC/IR — Learn: Zero-click watering hole delivery via n-day exploits on iOS/Android is a technique pattern worth tracking, but the summary provides no IOCs, specific CVE identifiers, or ATT&CK-mappable TTPs to act on today.
  • Leader — Learn: A Russian-linked large-scale mobile targeting campaign is worth flagging in the context of executive device security posture, but no sector attribution or specific organizational exposure is established — monitor for follow-on reporting with more detail.
Act APT29 Hijacks Plerdy Analytics Script in iOS/Android Watering Hole Campaign
2026-11-04 · The Hacker News · source ↗ #apt29#supply-chain#watering-hole
  • Engineer — Plan: Audit your web properties for use of Plerdy SEO Tracker and any other third-party analytics scripts; remove or isolate if found, and review Content Security Policy coverage to limit blast radius of injected third-party JavaScript.
  • SOC/IR — Act: Review Sekoia’s full research for IOCs and indicators tied to this campaign; hunt proxy/DNS logs for Plerdy-related domains and unexpected JavaScript attribute-harvesting patterns on web properties serving your users or employees.
  • Leader — Plan: Initiate a vendor-risk review of third-party analytics scripts across corporate web properties; a nation-state supply chain attack on a web analytics provider is precisely the vector that bypasses perimeter controls and warrants a policy on approved script sources.