Russian Hackers Exploit Safari and Chrome Vulnerabilities in Major Cyberattack
Cybersecurity researchers have identified several active exploit campaigns that targeted Apple Safari and Google Chrome browsers, using now-patched vulnerabilities to infect mobile devices with information-stealing malware.
“These campaigns utilized n-day exploits, which, while patched, remain effective on unpatched devices,” said Clement Lecigne, a researcher from Google’s Threat Analysis Group (TAG), in a report shared with The Hacker News.
The activity, recorded between November 2023 and July 2024, is particularly noteworthy for deploying exploits via a watering hole attack on Mongolian government websites, including cabinet.gov[.]mn and mfa.gov[.]mn.
The intrusion has been tentatively attributed to a Russian state-sponsored threat actor known as APT29 (also called Midnight Blizzard). The tactics used in these campaigns bear similarities to those associated with commercial surveillance vendors Intellexa and NSO Group, suggesting potential exploit reuse.
The vulnerabilities at the center of the campaigns are listed below -
For Further Reference