The campaign used multiple high-profile websites in the U.S., Ukraine, the Czech Republic, and Bulgaria that delivered the same payload for profiling visitors and their devices. This initial stage allows the attacker to determine the browser version to deploy "platform-specific n-day exploit chains without user interaction."
Researchers at cybersecurity company Sekoia attribute the operation with moderate-to-high confidence to APT29 (aka Midnight Blizzard), a Russian threat group that was recently linked to hotel WiFi attacks. Based on their findings, compromised legitimate sites belong to a Ukrainian gas producer, a U.S. chemical industry trade association, and a Bulgarian military-related site.
Lookalike domains impersonated the official America250 site and Raffles London at The OWO hotel, relaying content from the real sites in an adversary-in-the-middle attack model. The researchers also discovered that the threat actor had compromised Ukrainian web analytics service Plerdy and modified its SEO tracker, which was loaded by thousands of websites, mostly in Ukraine, between August 27 and September 3. In all cases, the initial payload was JavaScript code that profiled website visitors to determine their devices and browser versions.
