Russian Spy Group Hacks Website Linked to Bulgarian Army

A Russian spy group hacked a website linked to the Bulgarian army and used it to load malware onto phones

Researchers from the company Sekoia uncovered a campaign by the Russian hacking group APT29, also known as Cozy Bear — a group linked by Western intelligence agencies to Russia’s foreign intelligence service, the SVR. Part of the operation involved a hacked website linked to the Bulgarian army.

How the scheme worked: instead of directly attacking military systems, the hackers modified existing, trusted websites, including the Bulgarian one, so that they would infect the phones of selected visitors. When such a visitor opened the website, code invisible to them checked their phone model and browser version. If the victim matched their profile and their phone was not running the latest updates, the website attempted to install malware without the victim realizing it at all.

What the malware could do: in its more advanced variants, it could access messages, saved passwords, Wi-Fi passwords, location data and photos on the phone. The software did not remain permanently on the device — it stole the data and disappeared without leaving a trace of a long-term infection.

Important: the attacks worked only against phones without installed updates. The attack did not work on fully updated devices — which is why regularly updating your phone remains the simplest protection.

Other targets affected around the world included a Ukrainian gas company, a U.S. industrial association, a European political party’s website and, through a hacked website analytics tool, thousands of Ukrainian websites linked to the military.

Who are APT29: one of the best-known and longest-active Russian hacking groups, previously linked to large-scale operations against Western governments and political parties, including German parties, as well as the notorious attack against SolarWinds in 2020.

The researchers themselves describe the link to APT29 as probable, not conclusively proven, and acknowledge that they do not know how the group acquired the tools used to breach phones — they may have been purchased rather than developed by the hackers themselves.