APT29

November 5, 2026

• APT29 "PoisonedSource" watering holes delivered zero-click n-day chains to iOS and Android. Sekoia attributes with moderate-to-high confidence; the actor compromised Ukrainian web analytics provider Plerdy and modified its SEO tracker — loaded by thousands of mostly Ukrainian sites between August 27 and September 3 — alongside a Ukrainian gas producer, a US chemical trade association and a Bulgarian military site, plus AitM lookalikes of America250 and Raffles London. Profiling JavaScript selected the chain: Safari cookie theft on iOS 16.7 (CVE-2025-43529, CVE-2024-27834); WhatsApp/Telegram databases, Keychain credentials, location and photos on iOS 18.5 (five CVEs); and AndroSnitch against Chrome for Android 139–145, excluding 143 (Sekoia, BleepingComputer). · Nov 5 · observed · via drive by · Threat Activity

Sep 11 – September 13, 2026

• Anthropic's 154-page report gains actor-level detail. The Russian state-sponsored cluster it calls GTG-20006 — sharing tradecraft with Midnight Blizzard/APT29 — built an AI-assisted workflow to rebuild malware after detection, in a campaign against more than 20 government, intelligence, diplomatic and defence organisations (The Hacker News, The Record). GTG-50014 (aka MeowSHA), a French-speaking suspected ShinyHunters affiliate, ran 10 AWS EC2 workers that pulled 1.8 million distinct Android APKs, scanned them with TruffleHog and pushed verified secrets to Telegram; a second ShinyHunters affiliate hit SaaS vendors to reach roughly 50 downstream organisations and maintained an autonomous vulnerability-research programme producing working exploits for unknown flaws in network and security appliances (The Hacker News, earlier coverage). Anthropic also describes users in Houthi-held Yemen attempting weapons development, including a failed guided-rocket test, without fielding an operational device (SecurityWeek). Worth reading the caveats: @cyb3rops notes the "sandbox escape" was internet access enabled by a misconfiguration, not a VM or container escape, and the "safety monitor" was another LLM reviewing transcripts after the fact. · Sep 13 · observed · as gtg 20006, midnight blizzard, gtg 50014, shinyhunters, meowsha · AI-Enabled Threat Activity