The exploit was patched.
The opportunity remained.

WIRED’s August 2024 report by Lily Hay Newman explained how compromised Mongolian government websites became watering holes for visitors with vulnerable phones. The important contrast was between the tools’ earlier use as zero-days and their later use against unpatched devices. It was a story of capability reuse, not proof of an agreed partnership with a spyware vendor.

Google TAG reported campaigns observed between November 2023 and July 2024, affecting iOS and Android browser environments. It found exploits identical or strikingly similar to ones previously used by Intellexa and NSO Group, and assessed the campaigns’ link to the Russian government-backed actor APT29 with moderate confidence.

Google explicitly said it did not know how the actors acquired those exploits. Purchase, theft, leakage or independent adaptation should not be promoted from possible explanations to established facts. Similarity is evidence to examine, not a complete chain of provenance.

The business challenge is not simply telling staff to update. An organisation needs to know which devices and browsers it relies on, whether they are still supported and whether relevant changes actually reached them. A policy and a deployment result are different evidence.

Unsupported devices, inconsistent mobile management and applications that delay updates can all create an unresolved gap. Make the exception visible, assign an owner and decide whether it needs an alternative control or replacement.

A watering hole uses a site that the intended audience is likely to visit. The site’s legitimate purpose does not guarantee that every part of its current delivery is safe. That is why guidance limited to “do not click suspicious links” misses part of the problem.

For a business, the useful response joins supported browsers and devices, timely remediation and a route for investigating suspicious activity. It does not require every employee to identify a sophisticated exploit by looking at a page.

The original article also raised broader commercial-surveillance and physical supply-chain concerns. Those can be legitimate subjects for separate investigation, but this campaign does not establish every allegation about every surveillance company or a causal link to an unrelated hardware event.

Use risk to set priorities: the affected function, exposure, credible exploitation and business consequence matter. NIST’s enterprise patch-management guidance treats this as planned preventive maintenance within wider risk management, rather than an occasional technical clean-up.

A useful board measure is the unresolved exposure that matters to important work. An average patching percentage can hide a small number of consequential devices or a long-standing unsupported exception. Ask what the metric excludes.

Most people are not targets of sophisticated mercenary spyware, but the consequences can be serious for those who are. Consider the individual’s role, travel, sensitive information and credible threat evidence, rather than applying the same assumptions to every handset.

Apple’s current threat-notification guidance describes specialist assistance and optional stronger protection for appropriate cases. If a relevant notification or credible concern arises, use a trusted support route and preserve evidence as advised. Do not treat a restart or an ordinary antivirus result as definitive proof that the concern has been resolved.

The practical fresh insight is the lifecycle of a capability. An expensive exploit can become useful to more actors over time, while a published patch can remain absent from the devices that matter. That makes disciplined deployment and targeted support complementary investments.