APT29 Watering Hole: When Your Analytics Script Serves Exploits
Another week, another reminder that the most dangerous file on your website is the one you didn't write. Sekoia researchers have attributed a large-scale watering hole campaign, codenamed Poisoned Source, to Russia-linked APT29 — and the star of the show is not a zero-day or a clever phish. It is a humble analytics widget: the Plerdy SEO Tracker, a Ukrainian web analytics script quietly embedded on thousands of sites. One hijacked JavaScript include later, every one of those sites became a potential trap, serving platform-specific N-day exploit chains to iOS and Android visitors. As the crew behind Mēris, we live in HTTP floods and JavaScript challenges — and we find this vector... familiar.
One Script Tag, a Thousand Watering Holes
Poisoned Source actually used three infection vectors — compromised legitimate websites, lookalike fake domains, and the Plerdy supply chain attack — but it is the third one that should keep site owners awake at night. The victim list reads like an intelligence officer's shopping list: a major U.S. chemical industry trade association, a far-right European political party, a Bulgarian military-related website. All places whose visitors matter in the context of the Russia-Ukraine war.
That is the brutal economics of a supply chain attack: breach one vendor, and the victims deliver themselves. Botnets have abused third-party JS for years to inject cryptominers and Magecart-style skimmers; the only thing that changed here is who holds the syringe. Remember what a third-party include actually is: <script src="https://some-vendor/widget.js"> executes with full privileges in your origin. Your marketing site trusts that tag more than it trusts its own developers.
Fingerprint First, Exploit Second
Once injected, the loader does what any good bouncer does: it profiles. Browser and device attributes are collected and beaconed to the delivery infrastructure, which then decides whether you deserve an exploit. Search engines, security scanners, automated browsers — anything that smells like a bot gets nothing. The parallel DeadTag campaign, built on 660+ re-registered expired analytics and ad domains still loaded by thousands of sites, works exactly the same way.
This is precisely the logic behind every Cloudflare bypass, every JS challenge, every ip stresser and DDoS protection service that sorts humans from bots — just inverted. We fingerprint to keep bots out; APT29 fingerprints to keep researchers out. iOS targets receive the DarkSword exploit kit, harvesting cookies and full device data. Android victims get AndroSnitch, which lifts Chrome data and Wi-Fi passwords without even bothering with persistence. Everything exfiltrates to ad.starx-net[.]com:8881/telemetry/v12. Our favorite detail: the Android chain checks the model identifier and politely aborts on a Samsung Galaxy S25 Ultra (SM-S938B) — apparently the phone of choice for analysts this season.
N-Days Are the New Zero-Days
Sekoia's report underlines a trend we have been watching for a while: state actors increasingly rent Commercial Surveillance Vendor frameworks instead of building their own. Packaged N-day chains slash the cost and skill threshold of advanced mobile exploitation. Coruna, once a nation-state toy, leaked after disclosure and is now served from 608 domains; iPhones on iOS 13–17.2.1 get legacy Coruna, while devices on 18.4–18.7 get DarkSword P7 — also distributed via half-click attacks and a World Cup-themed Instagram ad. APT29 has form here: its 2024 Mongolian government watering hole chained CVE-2024-5274 and CVE-2024-4671 against Android Chrome users.
And the scary part? No click required. These are not phishing pages or fake app downloads — both kits attack the browser itself. Open the page on a vulnerable device, and the exploit breaks out of the browser and installs spyware. The real vulnerability being exploited here is the mobile patch gap.
The Takeaway
Third-party scripts remain the softest underbelly of the modern web — for botnets dropping miners, for skimmers, and, once again, for a state actor running a watering hole at scale. Audit your includes, deploy CSP and SRI where you can, monitor what your tags actually load at runtime, and remember that "it's just analytics" is what everyone says until the telemetry endpoint lives on port 8881.
And if you would like to know how your own stack behaves when someone less polite than your marketing team starts poking it, we offer a free stress test — layer 7 done the honest way: with permission.