APT29 Targets iPhones, Android Devices Across Ukraine, US, Europe in Zero-Click Campaign
The timing is not coincidental. Russia's sustained kinetic campaign against Ukrainian infrastructure (20+ strikes per night in early November per recent coverage) creates demand for targeting intelligence — which APT29 is now collecting passively.
A zero-click attack on older iOS and Android devices means no user interaction required; SVR gets device fingerprints, software versions, and cookie data from military staffers who simply visited a compromised analytics service.
The second move: Plerdy's compromise also exposed a far-right European political party and a U.S. chemical industry trade association, which suggests APT29 is running a broad collection operation, not a surgical one — the Ukraine military sites were high-value targets within a larger net.
APT29 just weaponized supply-chain access to Ukrainian military infrastructure at a moment when Russia is conducting sustained strikes on Ukrainian energy and command facilities.
The Plerdy compromise means SVR now has a passive collection point on military-adjacent traffic — not targeting individuals but identifying device vulnerabilities across a user base that includes active-duty personnel.
Watch whether Ukrainian military networks show new intrusions in the next 30 days; if APT29 is harvesting credentials from military staffers browsing unclassified services, that data feeds into targeting packages for the next wave of strikes.
Did Plerdy notify affected military organizations of the compromise, and have Ukrainian military networks detected follow-on intrusions from credentials or device data stolen during the August-September window?
Fault Lines
Strategic intelligence, synthesized daily — with a public track record. Every call graded against what actually happened.