Bulgarian military-related website used in cyberespionage campaign attributed to Russian intelligence-linked group APT29

An unnamed Bulgarian website with links to the military sector is among the sites used in a suspected cyberespionage campaign targeting Android and iOS users, Darik reported on 5 November 2026, citing French cybersecurity company Sekoia. The company attributes the campaign to APT29, a hacking group that the US and UK governments link to Russia’s Foreign Intelligence Service. The information has been published only by that outlet. At the time of publication, Flank has found no independent confirmation. This is a developing story and further information may be added.

Who APT29 is. APT29, also known as Cozy Bear and Midnight Blizzard, is a cyber-espionage group that the US and UK governments officially link to Russia’s Foreign Intelligence Service (SVR). They hold it responsible for the SolarWinds software breach discovered in December 2020, which gave access to networks of US government agencies. In 2020 the US, the UK and Canada accused it of trying to steal COVID-19 vaccine research, and in 2024 Microsoft said the group had gained access to emails of the company’s senior executives.

Website code modified to redirect visitors

According to Sekoia’s findings, cited by Darik, the attackers modified an existing JavaScript library on the Bulgarian website. The malicious code inserted allows visitors to be redirected to infrastructure controlled by the attackers.

The mechanism described uses a legitimate website to reach potential victims. However, compromising the website, redirecting a visitor and gaining access to their device are separate stages. The information reported is not sufficient to conclude that simply visiting the page results in a phone being infected.

According to Darik, the researchers describe the campaign’s aim as stealing passwords, emails, messages and location data, and gaining access to user accounts. This describes the suspected objective, rather than providing evidence that information has been stolen from Bulgarian users.

French cybersecurity company Sekoia attributes the campaign to APT29

According to Darik, Sekoia assesses with medium-to-high confidence that APT29, also known as Midnight Blizzard and Cozy Bear, is behind the campaign. The report describes the group as linked to Russia’s Foreign Intelligence Service. The stated confidence refers to the researchers’ assessment of who was responsible, not to independent confirmation of the case.

Darik reports that the operation was uncovered in mid-October 2026. According to the same report, the affected sites include a Ukrainian gas production company’s website, a website in the US chemical industry and the website of a European far-right political party. The range of sites alone does not establish a common motive for the selection of all the targets.

Military links do not mean an attack on the Bulgarian Armed Forces

According to Darik, the investigation does not name the Bulgarian website or specify whether visitors were successfully attacked. The description “linked to the military sector” does not necessarily mean that it is an official website of the Ministry of Defence or the Bulgarian Armed Forces.

Questions remain over who operates the website, how long it was compromised and whether any devices were affected or information leaked. Answering them requires Sekoia’s original technical investigation and confirmation from the operator or the relevant authorities. At this stage, there are no grounds to conclude that Bulgarian military networks have been penetrated.