SockAnalyst
← All playbooks
HighExploited vuln · 2026-11-04

APT29 watering holes hit unpatched iOS/Android; CISA adds Apple CVE-2024-27834 to KEV

What happened

CISA added CVE-2024-27834 (Apple improper authentication / Pointer Authentication bypass, CVSS 5.5) to the KEV catalog on November 4, 2026 after evidence of active exploitation. Sekoia attributes a mid-October 2026 watering-hole campaign with moderate-to-high confidence to APT29 (Midnight Blizzard / Cozy Bear). Attackers compromised legitimate sites, stood up AiTM lookalike domains, and briefly hijacked Ukraine's Plerdy SEO Tracker to inject fingerprinting JavaScript, then served platform-specific n-day exploit chains with no user click. One iOS 16.7 chain pairs WebKit RCE CVE-2025-43529 with the CVE-2024-27834 PAC bypass to steal browser/app cookies; other chains target iOS 18.5 for broader device data and Android Chrome for cookies and Wi-Fi passwords. All targeted flaws are already patched by Apple and Google.

Who's affected

Visitors to compromised or impersonated sites (US, Ukraine, Czech Republic, Bulgaria and related targets) on unpatched iOS or Android Chrome. Federal agencies must remediate CVE-2024-27834 by the CISA due date of November 18, 2026.

✅ Fix / patch

  • Update Apple devices to a release that includes the May 2024 fixes for CVE-2024-27834 (e.g. iOS/iPadOS 16.7.8 or 17.5, macOS Sonoma 14.5, Safari 17.5, and later) and apply the latest iOS/Android/Chrome security updates so the full n-day chains cannot land.
  • Block or alert on the published delivery and exfil domains/IPs from Sekoia (flux-telemetry, clouds-stacks, starx-net, AiTM lookalikes).
  • If users may have hit a watering hole: force sign-out of browser sessions, rotate passwords for high-value webmail/SSO accounts, and treat stolen cookies as session theft until rotated.

🔎 Quick hunt check

DNS or proxy hits to static.flux-telemetry[.]com, edge-ord.clouds-stacks[.]com, ad.starx-net[.]com, america250[.]holiday, theowo[.]club, or IPs 109.104.106[.]107 / 195.58.140[.]105; unusual POSTs to /telemetry/v12 on those hosts; and sites still loading tampered third-party trackers.

MITRE ATT&CK: T1189, T1195.002, T1203, T1539, T1557

IOCs

  • IP addresses: 109.104.106[.]107, 195.58.140[.]105, 95.133.231[.]28, 192.121.46[.]25, 188.190.17[.]232
  • Domains: static.flux-telemetry[.]com, edge-ord.clouds-stacks[.]com, ad.starx-net[.]com, america250[.]holiday, theowo[.]club, adsprism-stat[.]com
  • SHA-256 hashes: bee3e014e3df87ddce0250b0985b87f6868a427a7b650a74b7ffedb9d57f3088, a7d2493df00565c21587b0cad2a9fe7ca1e5590acf796da6e499be0ffde44cc3, 69b6cb327a4d5da99399718f6a66f84de69f89425b0a31f2dcee0682f811596f, 183d62d682aea8018491c8559544e8d6a9ab0e1abd05ecbb6c97daa4f438d2b8, 387a7fb768db1350a9788d9704e7a72abe07152734e0ff026af72b417e36268c

Hunt queries

Starting points built only from published indicators. Field names vary; tune before use.

index=* (dest_host="*flux-telemetry*" OR dest_host="*clouds-stacks*" OR dest_host="*starx-net*" OR dest_host="america250.holiday" OR dest_host="theowo.club" OR dest="109.104.106.107" OR dest="195.58.140.105" OR dest="95.133.231.28" OR dest="192.121.46.25" OR dest="188.190.17.232" OR url="*/telemetry/v12*")
| stats count min(_time) as first max(_time) as last values(src) as src by dest, dest_host, url
let badDomains = dynamic(["flux-telemetry.com","clouds-stacks.com","starx-net.com","america250.holiday","theowo.club","adsprism-stat.com"]);
let badIPs = dynamic(["109.104.106.107","195.58.140.105","95.133.231.28","192.121.46.25","188.190.17.232"]);
DeviceNetworkEvents
| where RemoteIP in (badIPs) or RemoteUrl has_any (badDomains) or RemoteUrl has "/telemetry/v12"
| summarize Hits=count(), FirstSeen=min(TimeGenerated), LastSeen=max(TimeGenerated) by DeviceName, RemoteIP, RemoteUrl, InitiatingProcessFileName

⏱ CISA deadline

CVE-2024-27834CVSS 5.5 Medium (v3.1, NVD)
--
Federal due 2026-11-18

Sources

Related playbooks