APT29 Hijacks Plerdy Analytics Script in iOS/Android Watering Hole Campaign

Wed, 04 Nov 2026 18:40:06 +0000

Engineer — Plan: Audit your web properties for use of Plerdy SEO Tracker and any other third-party analytics scripts; remove or isolate if found, and review Content Security Policy coverage to limit blast radius of injected third-party JavaScript.
SOC/IR — Act: Review Sekoia’s full research for IOCs and indicators tied to this campaign; hunt proxy/DNS logs for Plerdy-related domains and unexpected JavaScript attribute-harvesting patterns on web properties serving your users or employees.
Leader — Plan: Initiate a vendor-risk review of third-party analytics scripts across corporate web properties; a nation-state supply chain attack on a web analytics provider is precisely the vector that bypasses perimeter controls and warrants a policy on approved script sources.

Russian hackers use n-day zero-click exploits in mobile watering hole campaign

Wed, 04 Nov 2026 18:40:06 +0000

Engineer — Skip
SOC/IR — Learn: Zero-click watering hole delivery via n-day exploits on iOS/Android is a technique pattern worth tracking, but the summary provides no IOCs, specific CVE identifiers, or ATT&CK-mappable TTPs to act on today.
Leader — Learn: A Russian-linked large-scale mobile targeting campaign is worth flagging in the context of executive device security posture, but no sector attribution or specific organizational exposure is established — monitor for follow-on reporting with more detail.