Key facts
- Sekoia assessed with moderate to high confidence that the attackers were part of Russia's Foreign Intelligence Service.
- Attackers registered america250[.]holiday and used it as a reverse proxy to america250.org, injecting malicious JavaScript.
- A second site, theowo[.]club, proxied Raffles of London OWO, a luxury hotel near the Ministry of Defence and 10 Downing Street.
- Sekoia said the intrusion set may have deliberately chosen america250.org for its link to a high-profile national celebration.
- Payloads tailored to each platform attempted to steal browser cookies, and in some cases Wi-Fi passwords and full mobile device data.
Security firm Sekoia said on November 4 that hackers it assessed with moderate to high confidence were part of Russia's Foreign Intelligence Service exploited previously patched iOS and Android flaws in an attempt to hack visitors of multiple websites, including one celebrating the 250th anniversary of the signing of the US Constitution.
The attacks began when iPhone or Android users visited one of potentially hundreds of different sites. JavaScript injected into the traffic profiled the device, and final payloads tailored to the platform attempted to steal browser cookies and, in some cases, Wi-Fi passwords and full mobile device data.
One impersonated site was america250.org, belonging to a non-partisan group of lawmakers, business executives and at least one former member of the Trump administration. The attackers registered america250[.]holiday and used it as a reverse proxy to america250.org, delivering content from the real site with malicious JavaScript added.
Sekoia researchers said: "We assess that the intrusion set may have deliberately selected this website due to its association with a high-profile national celebration, potentially leveraging the event as a pretext for invitation-themed spear-phishing campaigns."
A second website, theowo[.]club, proxied the site of Raffles of London OWO, a luxury hotel physically close to the Ministry of Defence and 10 Downing Street. Open source reporting indicates Ukrainian President Volodymyr Zelenskyy stayed there during a visit on October 14.