A cloned copy of the Raffles London at The OWO website sat next to Downing Street and the Ministry of Defence for weeks without anyone noticing. Sekoia, which calls the campaign Poisoned Source, links it to APT29, the SVR group also known as Midnight Blizzard.
Ukrainian President Volodymyr Zelensky reportedly stayed at that hotel on October 14. The fake page, hosted on a lookalike domain, relayed traffic to the real site while injecting a profiler script.
Three doors, one payload
The operators broke into legitimate sites in the US, Ukraine, the Czech Republic and Bulgaria, built clones of high-profile destinations, and hijacked an analytics tracker called Plerdy between August 27 and September 3. The tracker loads on thousands of Ukrainian sites, including army, special forces and drone procurement pages.
Every route ended at a script that fingerprinted the browser and device, then handed out a platform-specific chain. Two target iOS through the commercial DarkSword kit. One targets Chrome builds 139 to 145 on Android, deliberately skipping version 143.
The economics have flipped
Every exploit in the chains is an n-day. Sekoia argues that packaged n-day kits, largely bought rather than built, have dropped the cost of advanced mobile compromise to the price of a subscription.
Attribution rests on shared tooling and targets. The group did not need a new vulnerability to reach diplomats, which is the part defenders should notice. If the payload lands, patching after disclosure is 2024’s news.
