Old, patched phone bugs are still useful to state hackers, as long as enough people have not updated.
Cybersecurity firm Sekoia reports that Midnight Blizzard, also known as APT29 or Cozy Bear and believed to be sponsored by Russia’s Foreign Intelligence Service (SVR), targeted iOS and Android users in Europe and the US with zero-click exploits for n-day vulnerabilities, meaning flaws that had already been patched, SecurityWeek reported on November 5.
Poisoned and cloned websites
The large-scale watering hole campaign used compromised or cloned websites of organizations in the US, Ukraine, the Czech Republic and Bulgaria. Attackers injected malicious JavaScript into legitimate sites to fingerprint visitors before delivering exploits. They also registered two lookalike domains that acted as reverse proxies, serving malicious copies of america250.org, the site for the 250th anniversary of American independence, and the site of a London hotel near UK government buildings.
The group also compromised Ukrainian web analytics service Plerdy in a supply chain attack, adding its code to the tracker file. SecurityWeek says this exposed hundreds of websites to the exploit kit for a week.
Three exploit chains
Sekoia identified two iOS chains and one Android chain, all aimed at previously patched flaws. The iOS chains lean heavily on the DarkSword exploit kit uncovered earlier this year. One uses CVE-2024-27834 to bypass Apple’s Pointer Authentication and steal cookies. The other aims to harvest the device fully, including messages, emails, credentials, contacts, photos and iCloud Drive content. The Android chain uses a Chrome bug patched in March and a Qualcomm bug patched in August 2025, then deploys a payload called AndroSnitch to steal Chrome cookies, passwords, history and Wi-Fi passwords.
On November 4, CISA added CVE-2024-27834 to its Known Exploited Vulnerabilities catalog and gave federal agencies until November 18 to patch. Sekoia warns that packaged n-day exploit chains lower the cost of advanced mobile attacks.
Why it matters
Every exploit in this campaign had a fix available. Unpatched phones, including employee-owned devices that touch corporate email and apps, were the real weakness.
For IT teams, this is a reason to enforce minimum OS versions through mobile device management. For mobile security and MDM vendors, it is a concrete, current case to share with prospects.
Source: SecurityWeek, Sekoia. Written by the xRapid Media LLP team.
About xRapid Media
xRapid Media LLP is a High Tech B2B Marketing company for technology businesses: software and SaaS companies, IT services and managed service providers, and hardware and IT product vendors. Our team combines positioning and content, account-based marketing, paid ads funnels, verified B2B data, intent signals, email and LinkedIn outreach and appointment setting to help you reach the right buyers and turn their attention into qualified leads and meetings.
Want help putting ideas like these into practice? Email [email protected] or book a time with our team.