IGoogle uncovers APT29’s use of spyware vendor exploits to target Mongolian government sites in a sophisticated series of cyberattacks
Russian state-sponsored hacking group APT29, also known as “Midnight Blizzard,” has been leveraging iOS and Android exploits originally developed by commercial spyware vendors in a series of cyberattacks between November 2023 and July 2024. Google’s Threat Analysis Group (TAG) uncovered the activity, revealing that although the n-day vulnerabilities have been patched, they remain effective on devices that have not been updated.
APT29 specifically targeted Mongolian government websites, employing “watering hole” tactics to compromise legitimate sites with malicious code. These attacks aimed to deliver payloads to visitors meeting specific criteria, such as device architecture or IP-based location.
In November 2023, APT29 compromised the websites ‘mfa.gov[.]mn’ and ‘cabinet.gov[.]mn’, injecting a malicious iframe to exploit CVE-2023-41993. By July 2024, the group had exploited vulnerabilities in Google Chrome (CVE-2024-5274 and CVE-2024-4671) to target Android users visiting ‘mga.gov[.]mn’, stealing cookies, passwords, and other sensitive data stored in the victims’ browsers.
The exploits used by APT29 are strikingly similar to those previously employed by spyware vendors NSO Group and Intellexa. The exploit for CVE-2024-5274 appears to be a modified version of an NSO Group zero-day from May 2024, while the CVE-2024-4671 exploit bears similarities to Intellexa’s earlier attacks.
It remains unclear how APT29 obtained these sophisticated exploits, which were originally the domain of commercial spyware firms. Speculation includes the possibility of the hacking group infiltrating these vendors, bribing insiders, or collaborating directly or through intermediaries to access the technology.
