US Edition
Microsoft Catches Russian Hackers Targeting Foreign Embassies
MOSCOW, RUSSIA, JUL 31 – Secret Blizzard uses adversary-in-the-middle tactics at ISP level to deploy ApolloShadow malware, enabling long-term espionage against diplomatic missions, Microsoft says.
- Microsoft observed in February 2025 that Russian hackers known as Secret Blizzard used ISP-level adversary-in-the-middle attacks to target foreign embassies in Moscow.
- This espionage effort, which began last year, exploits Russian ISPs mandated to assist the government in intercepting and redirecting internet traffic.
- Secret Blizzard directs targets behind captive portals to install ApolloShadow malware, which adds a TLS root certificate that impersonates trusted websites within infected embassies.
- Microsoft advised routing all traffic through encrypted tunnels to trusted networks rather than local ISPs, especially for personnel handling sensitive data, to avoid exposure to these attacks.
- Microsoft confirmed this is the first known ISP-level espionage capability by the FSB-linked group and warned the campaign poses significant risks to diplomatic missions relying on local internet providers in Moscow.
37 Articles
37 Articles
Kremlin-backed hackers target foreign embassies in Moscow
Kremlin-backed hackers are targeting foreign embassies in Moscow, Microsoft warned. Russian internet service providers are obliged to work with the government, and attackers use them to plant malware on diplomats’ computers, apparently allowing them to see passwords and bank details and to change what users see, perhaps showing them fake login pages. The group behind the effort is believed to be a Russian security service unit, and among “the wo…
Russian cyber espionage group Turla, also known as Secret Blizzard, has been trying to spy on foreign diplomatic missions in Moscow, hacking local Internet providers and redirecting traffic to victims.
Russian cyberspies hit embassies in Moscow, Microsoft reports
The group is using an "adversary-in-the-middle" technique to deploy its custom "ApolloShadow" malware for intelligence collection. This campaign, active since at least 2024, poses a high risk to diplomatic entities and sensitive organizations in Moscow, particularly those relying on local internet providers.
Coverage Details
Bias Distribution
- 44% of the sources lean Left, 44% of the sources are Center
Factuality
To view factuality data please Upgrade to Premium
