“The exploit from this watering hole used the exact same trigger as the exploit used by Intellexa as seen in the screenshot below, strongly suggesting the authors and/or providers are the same.”
Mongolian government websites served iPhone and Chrome exploits from November 2023 to July 2024, and Google suspects Russian-backed APT29. The exploits matched ones Intellexa and NSO Group had used as zero-days. Google does not know how APT29 got them. Commercial spyware does not stay with the customer who paid for it.