Sekoia Attributes Plerdy Tracker Compromise Campaign to APT29
Sekoia researchers documented a campaign attributed to APT29 that abused a compromised Plerdy analytics script and other web vectors to deliver exploits for mobile devices that have since been patched.
APT29’s Plerdy compromise was a campaign that, according to research by Sekoia, used trusted websites to selectively deliver exploits for iOS and Android. Sekoia attributes it to APT29 and says the attackers used a compromised Plerdy tracker and other web vectors. They inserted malicious JavaScript into the Plerdy SEO Tracker service. Plerdy said it removed the unauthorized code on September 3, 2026.
Sekoia published its findings on November 4. According to the researchers, the tracker compromise lasted from August 27 to September 3, 2026. The risk affected visitors to websites using the compromised script, especially those with unupdated mobile devices.
APT29’s Plerdy compromise and delivery method
The malicious script first collected a detailed device and browser fingerprint. The server then used the collected data to decide whether to send the visitor an exploit chain matching their environment. Sekoia also described other distribution paths: direct injections on legitimate websites and spoofed proxy domains that imitated the America250 and Raffles London at The OWO websites.
According to the available findings, these were not previously unknown vulnerabilities. The attackers used so-called n-day flaws, meaning flaws for which patches were already available. Secondary reports state that Apple and Google released patches for the affected issues. The campaign therefore does not concern a currently unpatched exploit, but the exploitation of devices without security updates.
Sekoia attributes the activity to APT29, also known as Midnight Blizzard, with medium-high to high confidence. However, this is an analytical assessment by researchers, not a publicly confirmed finding by a state authority.
Confirmed supply-chain breach
Plerdy confirmed unauthorized access to its environment through stolen administrator credentials. After the incident, the company reset passwords and sessions and reported the case to Ukraine’s CERT-UA team.
The company also said it found no evidence that data belonging to visitors of its customers’ websites had been stolen. This claim has not yet been independently verified. The published information also does not state how many phones were successfully compromised or identify specific victims.
The core of the case is the compromise of a vendor’s external JavaScript. Such a script is loaded directly in a visitor’s browser, so its abuse can affect visitors to a large number of otherwise legitimate websites. Sekoia says the potential impact extended to thousands of predominantly Ukrainian websites.
What users and website operators should do
For users, a known mitigation is to update iOS, Android, and the Chrome browser to a currently supported version. The risk described in the campaign is tied to the period of its activity and to vulnerabilities that have already been patched.
Website operators should review the external scripts their sites load, including analytics and marketing tools. In this incident, the focus is on Plerdy SEO Tracker deployments between August 27 and September 3, 2026.
Further information may come from a potential independent statement by CERT-UA, Apple, or Google. A more detailed list of affected domains, indicators of compromise, and forensic investigation results from Sekoia or Plerdy may also be expected. Successful data theft and the extent of any victims outside Ukraine have not been publicly substantiated so far.
Sources
- Sekoia – Technical research on the campaign, the Plerdy compromise window, fingerprinting, exploit delivery, and the attribution assessment linking it to APT29.
- Plerdy – Confirmation of unauthorized access, the insertion of unauthorized code into the tracker, its removal on September 3, and the remediation steps taken.
- Ars Technica – Independent summary of the three distribution vectors, exploit chains requiring no further interaction, and the fact that the flaws had already been patched.
- BleepingComputer – Corroboration of the affected platforms, the n-day nature of the flaws, and the availability of patches from Apple and Google.
Verified and updated: 11/05/2026 06:24
