Cyber ​​espionage: Russia suspected of being behind a new campaign aimed at extracting data from smartphones by trapping websites

Russia would therefore have struck again in the cyber universe. A cyberespionage campaign targeting cellphones has been documented and attributed to the Kremlin by French cybersecurity company Sekoia, which published a report on the subject on Wednesday. It says it has spotted a campaign intended "to steal browser cookies and, in some cases, Wi-Fi passwords or entire data" from mobile phones.

These cyberattacks were based on the "watering point" technique, which consists of trapping a website to reach Internet users. The attackers targeted around ten belonging to American companies or to a far-right party "to inject malicious code", details Amaury-Jacques Garçon, cyberthreat analyst at Sekoia, to AFP. They also created malicious sites, which imitated legitimate sites, including duplicating that of a British hotel located opposite the Ministry of Defense.

“The intrusion group may have sought to target diplomatic delegations and high-profile guests,” Sekoia points out. Extract data “without leaving a trace” In total, the group of attackers carried out their operation with three infection vectors, the first being the direct injection of Javascript code on legitimate sites. It also relied on domain names of the "man-in-the-middle attack" type (during which a malicious actor discreetly inserts itself between two interlocutors, Editor's note).

Finally, he attacked a Ukrainian operator whose trackers are used in “thousands of websites, the vast majority of which are Ukrainian”. In all three cases, the result was the same, namely the injection of code changing an external script (computer program) in order to profile the website visitor's browser and device. The hosting server then deployed exploitation chains (combination of flaws), without the user doing anything.

Among them was Darksword, a suite of tools for hacking iPhones. The intrusion group thus managed to extract cookies or all of the data from Apple smartphones. In the case of Android smartphones, it is the Chrome data and Wifi passwords that they have recovered.

All this, “without leaving a trace”, insists Sekoia. Several thousand people affected "To estimate the number of end users who would have been affected by this campaign, it's a bit complicated, it really depends on the traffic of each site", explains Amaury-Jacques Garçon, who mentions "several thousand" of people potentially affected. The attacks used cyber vulnerabilities on old versions of mobile applications.

Internet users who had installed the updates could not be affected. In the case of Darksword, Apple notably deployed a patch last April to plug the flaw. “We estimate, with medium to high confidence, that this campaign was carried out by APT29, a Russia-linked intrusion group largely attributed to the Russian Foreign Intelligence Service (SVR),” the company said.

Machine-translated from French