Hackers use n-day exploits in zero-click attacks on iOS and Android devices

Russian-associated hackers conducted a large-scale watering-hole attack targeting visitors to compromised websites or fake sites impersonating legitimate portals in the United States, Ukraine, the Czech Republic, and Bulgaria. The campaign used JavaScript to profile visitors and their devices before delivering a platform-specific exploit chain. Sekoia attributes the operation with moderate-to-high confidence to APT29, also known as Midnight Blizzard.