Russia-linked group APT29 targeted iOS and Android users through hijacked websites and a compromised analytics service.