APT29
One Hijacked Analytics Script, and Russian iPhone Exploits on Thousands of Websites
For a week in late summer, a popular Ukrainian analytics script quietly loaded spyware-delivery code onto every site that used it. Here's what we found when we went looking: a delivery server nobody had published, a website still infected after the story broke, and the same iPhone