A Russia-linked intrusion set associated with APT29 has been tied to a wide-ranging watering hole operation that weaponizes a Ukrainian web analytics service to push exploits at iOS and Android visitors, according to research published by Sekoia and reported by The Hacker News.
The campaign stands out less for its payloads than for its delivery mechanism. Rather than compromising individual sites one at a time, the operators appear to have targeted Plerdy SEO Tracker, a Ukrainian analytics product whose script is embedded across a large number of websites. That single point of compromise gave the attackers a foothold on every site loading the tracker — a textbook supply chain play in which trust in a third-party vendor is converted into reach.
How the Injection Works
According to Sekoia researchers Amaury-Jacques Garçon and colleagues, the tampered analytics script carries injected JavaScript whose first job is reconnaissance. It harvests browser and device attributes from each visitor, allowing the operators to fingerprint connections and decide which targets are worth pursuing. Only visitors matching the desired profile — specific mobile platforms in particular — are routed toward exploit content, while everyone else sees nothing unusual.
The campaign also leans on fake domains and compromised legitimate websites to widen its net, a layered distribution model that complicates both detection and takedown. Because the malicious logic rides inside a script that site owners deliberately added to their pages, conventional defenses such as reviewing first-party code or monitoring for unauthorized changes to a site's own files will not flag it.
Why Mobile Browsers Are the Target
Mobile exploitation has become an attractive avenue for state-aligned actors because the attack surface is broad and the patching cadence is uneven. iOS and Android users frequently run older operating system versions, and browser engines on mobile are tightly coupled to the underlying platform, meaning a single browser exploit can yield deep access. Watering hole campaigns that profile visitors before serving payloads also reduce exposure of the exploit itself, making it harder for researchers and crawlers to capture samples.
Attribution to APT29 — the cluster widely linked to Russia's foreign intelligence service — rests on infrastructure and tooling overlaps documented by Sekoia. As with most attribution in this space, the assessment should be treated as a probability judgment rather than a certainty, though the targeting pattern is consistent with the group's long-standing interest in espionage against government, diplomatic, and technology-sector audiences.
The Analytics Supply Chain Problem
Third-party scripts are among the least-governed components of modern web estates. Tag managers, analytics beacons, chat widgets, and A/B testing libraries routinely execute with full access to the page, including the ability to read form fields and redirect users. Security teams often have no inventory of which vendors load on which properties, and even fewer have integrity controls in place.
The Plerdy incident illustrates the consequence: a vendor compromise silently propagates to customers who have no direct relationship with the attacker and no visibility into the vendor's code changes. Organizations that rely on analytics vendors should treat those scripts as part of their attack surface, not as marketing tooling outside the security perimeter.
Defensive Priorities
Security teams can take several practical steps in response:
- Inventory third-party scripts. Enumerate every external script loaded across public web properties and identify the business owner for each.
- Enforce Subresource Integrity where possible. Pinning script hashes prevents silent modification, though it requires vendors to version their assets predictably.
- Apply Content Security Policy. Restricting script sources and blocking inline execution limits the blast radius of a compromised vendor.
- Monitor for behavioral anomalies. Watch for unexpected redirects, unusual device fingerprinting, or scripts that conditionally load content based on user agent.
- Patch mobile endpoints promptly. Keeping iOS and Android devices current remains the most reliable defense against browser exploitation.
- Harden high-risk users. Those in diplomatic, governmental, and technology roles should be prioritized for device management and phishing-resistant authentication.
What Comes Next
The campaign is a reminder that supply chain risk in the web ecosystem is not limited to npm packages and CI pipelines. Any shared component — including a marketing analytics tag — can become an intrusion vector when the adversary's objective justifies the investment. For defenders, the lesson is that visibility into what runs in the browser is now as important as visibility into what runs on the endpoint.
Organizations that discover the Plerdy script on their properties should assume visitor traffic was fingerprinted and review logs for anomalous redirects or exploit delivery attempts targeting mobile clients.
