Sekoia's Threat Detection and Research team published an account on 4 November of an APT29 watering hole campaign serving exploit chains to iOS and Android visitors. The same day, CISA added a patched Apple flaw, CVE-2024-27834, to the federal catalogue of known exploited vulnerabilities.

These ran as two stories. They are one. CISA's entry cites Sekoia's research, and reading them together produces a finding that neither contains on its own.

The campaign

Sekoia found injected JavaScript on a Ukrainian gas production company, a United States chemical industry trade association, a Czech far-right political movement and a Bulgarian military-related site. Two further domains reverse-proxied and altered legitimate sites, one mirroring America250.org and one the Raffles London at The OWO hotel.

The supply chain leg is the one that scales. The Ukrainian analytics tracker Plerdy had its main script modified between 27 August and 3 September 2026. Plerdy is loaded by thousands of sites, most of them Ukrainian.

Visitors get a fingerprinting script that builds 394 JSON fields from 61 collectors. A second endpoint answers with exploit JavaScript, with no user interaction. Three fields can stop delivery, and one of them is a touch point count of zero, which is a cheap way of refusing desktops and sandboxes.

What the chains take depends on the device. The weaker iOS chain lifts browser cookies. The stronger one takes messages from SMS, iMessage, WhatsApp and Telegram, keychain items, Wi-Fi passwords, contacts, call history, Safari history, location caches, Health data, photos and iCloud Drive. The Android chain takes Chrome cookies, logins, history and Wi-Fi configuration files. Sekoia found no persistence.

Ten vulnerabilities, and the catalogue already held nine

Sekoia names ten CVEs across the three chains. We checked every one against the KEV catalogue as released on 4 November 2026, catalogue version 2026.11.04, 1,768 entries.

All ten are in it. Nine were listed before the research was published. The tenth is CVE-2024-27834, added that day.

The oldest is CVE-2025-27038, a Qualcomm Adreno driver flaw, in the catalogue since 3 June 2025 with a federal remediation deadline of 24 June 2025. The Chrome renderer bug the Android chain opens with has been listed since 13 March 2026. The three Apple flaws in the stronger iOS chain have been listed since 20 March 2026. The Chromium flaw and the shared iOS entry point have been listed since December 2025.

So an agency that had met every KEV deadline it was given would have been immune to all three chains on the day the research appeared. Sekoia says the same thing in its own language: there are no zero days here, and a fully updated device is safe from them.

That is not a small point about one campaign. It is the clearest available answer to the question of what the catalogue is for.

The flaw CISA added is a medium

CVE-2024-27834 scores 5.5. NVD and CISA's own assessment agree on it. The vector needs local access and existing privileges, and the description is blunt about the precondition: an attacker with arbitrary read and write capability may be able to bypass pointer authentication.

It is not an entry point. It is the step that makes an entry point worth having.

Apple fixed it in May 2024, across Safari 17.5, iOS and iPadOS 16.7.8 and 17.5, macOS Sonoma 14.5, tvOS 17.5 and watchOS 10.5. It then sat outside the catalogue for two and a half years.

It is the second low-scoring flaw in a week we have had cause to write about, after a 2.7 that was a zero day anyway. A score measures the bug by itself. A chain is worth more than its parts, and the catalogue is one of the few public records of which parts actually got used.

The clock it was given

The entry carries a due date of 18 November, a 14 day window, and its forensic triage flag is set to No.

That is the second tier of the system we described when CISA retired the three week clock. Under BOD 26-04 the hardest cases get three days and a forensic triage obligation. This one got neither. A two and a half year old medium, used by a Russian foreign intelligence service in a live campaign, is still not a three day problem under the directive's own rules.

Whether that is the right call is a judgement. That it is a deliberate, published, rule-driven call is the part worth knowing.

What to do

  • Stop reading KEV as a compliance list for federal agencies. On this evidence it is a usable parts list for at least one state actor.
  • Patch the Qualcomm and Chromium entries. Two of these three chains begin outside Apple.
  • Update mobile devices and say so to the people you support. Sekoia is explicit that current devices are not exploitable by these chains.
  • If you load a third-party analytics tracker, you are in somebody's supply chain. Plerdy was modified for a week.
  • Treat a touch point check in injected script as a signal rather than noise. It is there to avoid your sandbox.

What is not established

  • Whether the campaign targeted particular visitors or everyone who arrived. Sekoia says it cannot tell.
  • What the 394 fingerprint fields were for, or whether they shaped later stages.
  • How APT29 obtained the exploits. Sekoia suggests a third party and says it cannot confirm it.
  • Why Chrome 143 and one Samsung model were excluded from exploitation.
  • Victim identities, victim counts, and whether data was taken from any named organisation.
  • Attribution is Sekoia's, at moderate to high confidence, to APT29 or one of its subgroups. That is not certainty.