Midnight Blizzard: Mobile watering hole campaign targeting iOS and Android
Russian state-sponsored actor Midnight Blizzard (APT29) is leveraging watering holes and lookalike domains to deliver n-day exploit chains against mobile devices.
CVE search metadata
CVE search record: CVE-2025-43529. Severity: high. CVSS: 8.8. EPSS: 25.65%. KEV: no. Product: iOS (<= 18.5), Chrome for Android (139 to 145, excluding 143). Brief: Midnight Blizzard: Mobile watering hole campaign targeting iOS and Android. Brief link: https://feed.craftedsignal.io/briefs/2026-11-midnight-blizzard-mobile-watering-hole/
CVE search record: CVE-2024-27834. Severity: medium. CVSS: 5.5. EPSS: 1.41%. KEV: no. Product: iOS (<= 18.5), Chrome for Android (139 to 145, excluding 143). Brief: Midnight Blizzard: Mobile watering hole campaign targeting iOS and Android. Brief link: https://feed.craftedsignal.io/briefs/2026-11-midnight-blizzard-mobile-watering-hole/
CVE search record: CVE-2025-43520. Severity: medium. CVSS: 5.5. EPSS: 0.43%. KEV: no. Product: iOS (<= 18.5), Chrome for Android (139 to 145, excluding 143). Brief: Midnight Blizzard: Mobile watering hole campaign targeting iOS and Android. Brief link: https://feed.craftedsignal.io/briefs/2026-11-midnight-blizzard-mobile-watering-hole/
CVE search record: CVE-2026-3910. Severity: high. CVSS: 8.8. EPSS: 2.69%. KEV: no. Product: iOS (<= 18.5), Chrome for Android (139 to 145, excluding 143). Brief: Midnight Blizzard: Mobile watering hole campaign targeting iOS and Android. Brief link: https://feed.craftedsignal.io/briefs/2026-11-midnight-blizzard-mobile-watering-hole/
CVE search record: CVE-2025-27038. Severity: high. CVSS: 7.5. EPSS: 1.04%. KEV: no. Product: iOS (<= 18.5), Chrome for Android (139 to 145, excluding 143). Brief: Midnight Blizzard: Mobile watering hole campaign targeting iOS and Android. Brief link: https://feed.craftedsignal.io/briefs/2026-11-midnight-blizzard-mobile-watering-hole/
Triage facts
Revision 1- Applicability
- iOS (<= 18.5), Chrome for Android (139 to 145, excluding 143)
- Evidence
- Confirmed activeHigh confidence
- Severity
- High
- Sources
- 3 public sources
- Freshness
- Revision 1Nov 5, 11:40 UTC
- Detection
- 1 IOC
- Vulnerabilities
- 5 CVEs
- Source quality
- B2Very likely
What's new
- 1. added CVE-2024-27834 +4; OS ios 18.5; OS android; OS ios 16.7 Nov 5, 21:31 via pwn-watch
The cybersecurity firm Sekoia reports that the Russian state-sponsored threat actor Midnight Blizzard (APT29) has targeted iOS and Android users in the US and Europe through a large-scale watering hole campaign.
The campaign involves compromising or cloning high-profile websites to deliver malicious JavaScript that fingerprints visitors. In some instances, the actor utilized adversary-in-the-middle (AiTM) setups with lookalike domains to target high-profile organizations. The campaign relies on n-day exploit chains - utilizing the DarkSword exploit kit for iOS and targeting previously patched vulnerabilities for Android - to exfiltrate device data.
Indicators of compromise
1
domain
| Type | Value |
|---|---|
| domain | a.plerdy.com |