--- analysis: A static rule would only fire on known domains. This hunt uses a behavioral baseline for analytics script loading and correlates redirection with vulnerability findings to confirm actual exploitation risk. blind_spots: - id: encrypted-traffic-blindness question: The specific path and contents of the profiling script delivered over HTTPS requires: TLS inspection or transparent proxy logs risk: Without TLS inspection, the specific script paths like 'temfp.js' are invisible to hb_http_activity, leaving only domain-level visibility. stage: watering-hole-redirection - id: mobile-os-telemetry-gap question: Whether a non-enrolled mobile device was compromised while off the corporate VPN requires: Mobile EDR or specialized mobile telemetry risk: Exploitation of personally-owned or unmanaged mobile devices using corporate credentials will not be visible in endpoint-level surfaces. stage: client-side-profiling-and-exploitation coverage: - stage: watering-hole-redirection status: covered steps: - redirection-and-script-lead - stage: client-side-profiling-and-exploitation status: covered steps: - vulnerability-check - http-deep-dive - stage: mobile-data-exfiltration status: covered steps: - http-deep-dive guardrails: claims: no_unsupported evidence: citation_required missing_data: not_benign telemetry: untrusted hunt: applicability: campaign-specific handoff: keep-as-periodic-hunt justification: APT29's use of mobile exploit kits via high-profile watering holes targets high-value credentials and sensitive data (Wi-Fi passwords, cookies); a negative result confirms lack of exposure to this infrastructure. methodology: model-assisted trigger: intel-report hypothesis: An adversary has redirected users to a watering hole or compromised supply chain to profile mobile devices and deliver n-day exploits based on browser versions. labels: - hunt - attack.t1190 - attack.t1195 - attack.t1566 - attack.t1041 - execution - exfiltration - initial access name: Mobile Device Watering Hole and Exploitation parameters: c2_ips: default: - 109.104.106.107 description: Infrastructure IPs for delivery and exfiltration. from: kind: article observed: '2026-10-29' ref: https://www.sekoia.com/blog/poisoned-source-apt29-watering-holes-targets-mobile-devices-with-n-day-exploits type: list[ip] lookback_days: default: '14' description: Days of history to examine. type: number malicious_domains: default: - static.flux-telemetry.com - america250.holiday - america250.org - theowo.club - a.plerdy.com - edge-ord.clouds-stacks.com - ads-it-assets.com - cdn.adv-static.com description: Redirection and profiling domains named in the report. from: kind: article observed: '2026-10-29' ref: https://www.sekoia.com/blog/poisoned-source-apt29-watering-holes-targets-mobile-devices-with-n-day-exploits type: list[domain] target_cves: default: - CVE-2024-27808 - CVE-2024-27833 - CVE-2024-27834 - CVE-2025-14174 - CVE-2025-24201 - CVE-2025-27038 - CVE-2025-31277 - CVE-2025-43510 - CVE-2025-43520 - CVE-2025-43529 - CVE-2026-20700 - CVE-2026-3910 description: Mobile and browser CVEs exploited in the campaign. from: kind: article observed: '2026-10-29' ref: https://www.sekoia.com/blog/poisoned-source-apt29-watering-holes-targets-mobile-devices-with-n-day-exploits type: list[string] provenance: authors: - name: Huntbase hunt generation org: huntbase.io generated: by: huntbase-hunt-generation from: https://www.sekoia.com/blog/poisoned-source-apt29-watering-holes-targets-mobile-devices-with-n-day-exploits gates: - dry-run - lint model: hb_google/gemini-3-flash-preview rationale: Start with corporate endpoints that frequently access international news or government services. Focus on mobile devices enrolled in MDM first. references: - name: "Sekoia \u2014 Poisoned Source: APT29 Watering Holes Targets Mobile Devices" url: https://www.sekoia.com/blog/poisoned-source-apt29-watering-holes-targets-mobile-devices-with-n-day-exploits related: - hunt: mobile-mdm-vulnerability-audit reason: This hunt looks for active exploitation; a posture audit would proactively find every vulnerable mobile device. relation: alternative scenario: stages: - name: Watering Hole and Supply Chain Redirection observables: - a.plerdy.com - america250.holiday - theowo.club - america250.org - ads-it-assets.com - cdn.adv-static.com - window.onload - document.createElement('script') - script.src slug: watering-hole-redirection tactic: initial-access techniques: - T1190 - T1195 - T1566 - name: Client-Side Profiling and Exploitation observables: - static.flux-telemetry.com - edge-ord.clouds-stacks.com - module/5b4c8fea5cbcee273e8d830f52-temfp.js - UltimateFingerprinter - DarkSword - CVE-2024-27808 - CVE-2024-27833 - CVE-2024-27834 - CVE-2025-14174 - CVE-2025-24201 slug: client-side-profiling-and-exploitation tactic: execution - name: Mobile Data and Cookie Exfiltration observables: - exfiltration of cookies - exfiltration of Wi-Fi passwords - exfiltration of Chrome data - 109.104.106.107 slug: mobile-data-exfiltration tactic: exfiltration techniques: - T1041 summary: APT29 conducted a large-scale watering hole campaign targeting iOS and Android devices through compromised legitimate websites, AiTM proxy domains, and a supply chain compromise of the Plerdy analytics service. The campaign used an 'UltimateFingerprinter' script to profile victims and serve tailored n-day exploit chains (including the DarkSword iOS kit) to exfiltrate cookies, Chrome data, and Wi-Fi passwords without establishing persistence. severity: high targets: analyst: name: Tier-2 analyst role: analyst endpoint: category: endpoint name: Endpoint telemetry (hb_ surfaces) telemetry: - endpoint hunter: agent: true name: Hunt agent web: category: siem name: Web server / proxy logs telemetry: - network tlp: clear type: investigation --- # Mobile Device Watering Hole and Exploitation This hunt identifies a sophisticated watering hole campaign attributed to APT29 that targets mobile devices through compromised web analytics and reverse proxies. The campaign uses several infection vectors, including a supply-chain compromise of the Plerdy analytics service, to deliver profiling scripts and n-day exploit chains like DarkSword. The hunt begins with a behavioral lead query that baselines script inclusions from analytics providers and checks for known redirection domains. If suspicious traffic is confirmed, it fans out to correlate the exposure of browser and mobile CVEs on affected hosts with detailed HTTP telemetry for specific profiling script paths and exfiltration patterns. An agent weighs the intersection of these findings to identify successful exploitation. ## redirection-and-script-lead Find known redirection indicators and baseline JS script loads from analytics providers like Plerdy. ```sqlite target=web role=detection-candidate params=(malicious_domains=malicious_domains, lookback_days=lookback_days) ~~~yaml baseline: compare: new_this_window window: '{{lookback_days}}d' expected: A row indicates interaction with malicious infrastructure or a script load from Plerdy. Unusual script paths should stand out from baseline patterns. prevalence: by: device_hostname key: - url_hostname - url_path rare_below: 5 reads: - device_hostname - url_hostname - url_path - time silence: not_evidence_of_absence source: hb_http_activity verified: dry-run verified_at: '2026-11-05' ~~~ SELECT device_hostname, url_hostname, url_path, COUNT(*) AS requests, MIN(time) AS first_seen FROM hb_http_activity WHERE (instr(',' || '{{malicious_domains}}' || ',', ',' || LOWER(url_hostname) || ',') > 0 OR (LOWER(url_hostname) = 'a.plerdy.com' AND LOWER(url_path) LIKE '%.js')) AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY device_hostname, url_hostname, url_path ``` ## lead-agent ```agent target=hunter cite: required context: - redirection-and-script-lead max_iterations: 3 objective: Determine if any host shows interaction with malicious domains or unexpected script inclusions from the Plerdy supply chain. success_criteria: A verdict citing specific hosts and malicious/behavioral indicators. tools: - endpoint - web ``` ## gate if~: "the lead-agent verdict confirms at least one host queried a malicious domain or loaded an unusual script from a.plerdy.com" (confidence: high, judge=hunter) then: → fan-out indeterminate: → analyst-review unavailable: → analyst-review (blind_spot: encrypted-traffic-blindness) else: → close-out ## fan-out parallel: - → vulnerability-check - → http-deep-dive join: → triage ## vulnerability-check Identify hosts in the estate that are vulnerable to the specific n-day exploits used by the campaign. ```sqlite target=endpoint role=enrichment params=(target_cves=target_cves) ~~~yaml expected: A list of hostnames matching the campaign's target browser or mobile vulnerabilities. reads: - device_uid - cve_uid - severity - resource_uid silence: not_evidence_of_absence source: hb_vulnerability_finding verified: dry-run verified_at: '2026-11-05' ~~~ SELECT d.hostname AS device_hostname, vf.cve_uid, vf.severity, vf.resource_uid FROM hb_vulnerability_finding AS vf JOIN hb_devices AS d ON vf.device_uid = d.device_uid AND vf.provider = d.provider WHERE instr(',' || '{{target_cves}}' || ',', ',' || vf.cve_uid || ',') > 0 ``` ## http-deep-dive Detect the profiling script 'temfp.js' and potential exfiltration to known campaign IPs. ```sqlite target=web role=baseline params=(c2_ips=c2_ips, lookback_days=lookback_days) ~~~yaml baseline: compare: new_this_window window: '{{lookback_days}}d' expected: Hits on the profiling script path or specific C2 IPs (109.104.106.107). Rare hits are suspicious. prevalence: by: device_hostname key: - url_path - dst_endpoint_ip rare_below: 3 reads: - device_hostname - url_hostname - url_path - dst_endpoint_ip - time silence: not_evidence_of_absence source: hb_http_activity verified: dry-run verified_at: '2026-11-05' ~~~ SELECT device_hostname, url_hostname, url_path, dst_endpoint_ip, COUNT(*) AS count, MIN(time) AS first_seen FROM hb_http_activity WHERE (LOWER(url_path) LIKE '%temfp.js%' OR instr(',' || '{{c2_ips}}' || ',', ',' || dst_endpoint_ip || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY device_hostname, url_hostname, url_path, dst_endpoint_ip ``` ## triage ```agent target=hunter cite: required context: - lead-agent - vulnerability-check - http-deep-dive max_iterations: 5 objective: Identify the intersection of hosts that both visited the redirection infrastructure and possess the relevant browser or mobile CVEs to prioritize confirmed compromises. success_criteria: A verdict of malicious | suspicious | benign per host, prioritizing those where vulnerability findings overlap with malicious HTTP traffic. tools: - endpoint - web ``` ## route if~: "the triage verdict is malicious for at least one host showing the intersection of vulnerability and traffic" (confidence: high, judge=hunter) then: → isolate indeterminate: → analyst-review unavailable: → analyst-review (blind_spot: mobile-os-telemetry-gap) else: → analyst-review ## isolate ```action target=endpoint ~~~yaml approval: required ~~~ Isolate the host and revoke its cloud sessions while forensics proceed. ``` → analyst-review ## analyst-review ```manual target=analyst Review cited rows from http-deep-dive; look for POST requests to 109.104.106.107 suggesting cookie or password exfiltration. Verify the mobile OS version via hb_devices. ``` → end ## close-out ```manual target=analyst Record the negative results; if redirection was seen but no vulnerability exists, note for future patching priority. ``` → end