Midnight Blizzard Poisons Trusted Mobile Sites

Russia-linked Midnight Blizzard compromised and cloned trusted websites to silently target iPhone and Android visitors in Europe and the United States. The campaign used watering-hole websites and a compromised web analytics service to profile devices and deliver exploit chains that could steal sensitive mobile data.

Key findings

• Midnight Blizzard used compromised and cloned high-profile websites as watering holes to target mobile-device visitors.
• The malicious website code fingerprinted visitors' browsers and devices before delivering exploits.
• Lookalike reverse-proxy sites copied america250.org and the Raffles London at The OWO website, allowing attackers to inject malicious code.
• A compromised Plerdy web tracker exposed hundreds of websites, including military-related sites, to the exploit kit for one week.
• The iOS and Android payloads were designed to steal browser cookies, passwords, account data, messages, contacts, and other sensitive device information.

Who’s being targeted

• Commonly targeted roles: Government and diplomatic staff, Executive assistants, High-profile travelers, Military and defense personnel, Mobile device users, IT and security teams.
• Affected industries: Government and diplomatic organizations, Military and defense, Energy, Political organizations, Hospitality, Information technology services, Non-governmental organizations.
• Attack channels: website.
• Impersonated: Raffles London at The OWO, Plerdy web analytics service.

Awareness takeaways

• Treat trusted websites as a potential risk when they use third-party services; compromise of a supplier can expose visitors without any suspicious email or download.
• Verify the exact web address before visiting sites related to sensitive travel, government work, or high-profile events, especially when arriving through an unsolicited link.
• Install mobile operating-system and browser updates promptly, because attackers can exploit vulnerabilities even after fixes are publicly available.
• Assume a mobile-device compromise can expose more than work email; protect and report suspected compromise quickly because attackers may seek passwords, messages, contacts, and browser data.

Red flags to watch for

• The site may be a lookalike domain rather than the hotel's official address.
• Unexpected redirects or a URL that differs slightly from the known hotel domain should be treated as suspicious.
• A website does not need to ask for a download or password to be dangerous if the device is unpatched.
• Trusted websites can be affected through third-party analytics or advertising code.
• Keep mobile operating systems and browsers updated, because this campaign targeted vulnerabilities that had already been patched.
• Unexpected browser behavior on a sensitive or trusted site should be reported promptly.