Researchers disclosed this week that APT29, the Russian intelligence-linked group also known as Cozy Bear and Midnight Blizzard, spent late August through early September quietly rewriting a piece of JavaScript that sits on an unknown number of customer websites worldwide. The script belongs to Plerdy, a Ukrainian web analytics provider. APT29 modified it so that every visitor gets fingerprinted on the spot: iOS users get routed into the DarkSword exploit chain, Android users into a cookie-stealer called AndroSnitch, both built from components that trace back to commercial surveillance vendors. CISA added the related Apple Pointer Authentication bypass, CVE-2024-27834, to its KEV catalog on November 5, confirming active exploitation tied to the campaign.

What makes this worth stopping on isn’t the tradecraft, APT29 using n-day mobile exploits against unpatched devices is familiar ground. It’s the distribution model. APT29 didn’t pick targets and breach them. It picked a script that other people’s websites already trusted, and let the websites do the targeting for it. Every site that embedded Plerdy became a watering hole without doing anything wrong. That is the same play run twice more this week, by two unrelated actors with two different motives, and that pattern, not any single incident, is what practitioners need to sit with before Monday.

Analysis

Start with the mechanism, because it matters more than the actor. A watering hole in the classic sense means compromising a site your target is known to visit. This is watering-hole logic applied to a dependency instead of a destination: compromise the one piece of shared code that propagates itself into thousands of otherwise-unrelated sites, and you inherit all of their visitors at once. Plerdy is an analytics tag, the kind of third-party script security teams rarely inventory because it doesn’t touch the server side of anything. Nobody runs SBOM tooling against client-side JavaScript injected by a marketing vendor. That blind spot is structural, not a failure of any one organization’s patch program, and APT29 clearly understands it.

The second incident this week is the sharper one, because the trusted channel being hijacked belonged to a security vendor. An attacker created a fraudulent trial account on OPSSHIELD’s billing and licensing portal on November 1, used it to get arbitrary command execution on the licensing management server, and by November 2 pushed a trojanized update of cPGuard, OPSSHIELD’s own security agent, to roughly 2,950 customer servers. The update ran as root, as auto-updating security agents generally do, and the attacker walked out with close to 7,900 records of credentials and configuration data before anyone caught it. Read that sequence again: a billing signup form was the entry point, and a product sold specifically to protect servers was the delivery mechanism for backdooring them. The irony is obvious, but the lesson underneath it is not about OPSSHIELD specifically. Any auto-updating agent with root or admin privilege is, by construction, a single point that bypasses every other control in the environment the moment its vendor’s build or licensing infrastructure is compromised. Security products get that privilege by default and get audited for it less than almost anything else running on a server, because the entire point of installing one was to stop auditing that layer yourself.

The third case is quieter but closes the triangle. ESET disclosed that SlippyNunchucks, a China-aligned group active since 2023, has been abusing insecure HTTP update traffic in the Windows build of Sogou Input Method since July to push a configuration that deploys the DarkVigil backdoor against Chinese-speaking users in Hong Kong, Thailand, Japan, Vietnam, Oman and Sri Lanka. Tencent patched the underlying weakness as CVE-2026-120422 in Sogou 16.10 at the end of October, nearly three months after exploitation began. The vulnerability here isn’t exotic: an update channel that still checks for new versions over plain HTTP is trivially hijackable by anyone positioned on the network path, no zero-day required. That it took until late October to patch something this basic, in software with hundreds of millions of installs, says more about how little scrutiny input-method and utility software gets than it does about SlippyNunchucks’ sophistication.

Line the three up and the throughline is unmistakable: nation-state espionage, financially motivated credential theft, and a second nation-state espionage operation all converged on the same mechanism in the same 72 hours, independent of each other. None of them needed a zero-day in the target environment. All three needed is one compromised choke point that the target already trusted to update itself. That is a cheaper, higher-yield strategy than spearphishing a thousand individual organizations, and it scales in a way conventional intrusion doesn’t. It also defeats almost every control built around detecting an initial breach, because from the victim’s perspective nothing was breached. The update ran. The script loaded. That’s what they’re supposed to do.

For defenders, the practical gap is that vendor risk management today is built around the vendors you chose, not the ones your chosen vendors depend on. Nobody running a website decided to trust whatever upstream infrastructure Plerdy’s engineering team uses. Nobody running cPGuard audited OPSSHIELD’s billing portal for account-fraud controls. Those are two and three hops removed from any decision a security team actually made, and that is exactly where all three incidents this week landed.

What to watch

Two threads carry into next week. First, whether security researchers find other sites or scripts carrying the same APT29-modified Plerdy payload once the indicators circulate, since a watering hole built into shared infrastructure rarely has a blast radius that fits neatly inside one disclosure. Second, whether OPSSHIELD’s root-cause writeup, once it lands, shows whether the billing-portal fraud control gap is unique to OPSSHIELD or common across the security-agent vendor market, because if it’s the latter, this is the first incident in a pattern, not the only one.

Security Unlocked publishes threat intelligence and strategic analysis twice weekly. This mid-week brief covers developments from Monday, November 2, 2026 through Thursday, November 5, 2026.