Menu

  • Alerts
  • Incidents
  • News
  • APTs
  • Cyber Decoded
  • Cyber Hygiene
  • Cyber Review
  • Cyber Tips
  • Definitions
  • Malware
  • Threat Actors
  • Tutorials

Useful Tools

  • Password generator
  • Report an incident
  • Report to authorities
No Result
View All Result
CTF Hack Havoc
CyberMaterial
  • Education
    • Cyber Decoded
    • Definitions
  • Information
    • Alerts
    • Incidents
    • News
  • Insights
    • Cyber Hygiene
    • Cyber Review
    • Tips
    • Tutorials
  • Support
    • Contact Us
    • Report an incident
  • About
    • About Us
    • Advertise with us
Get Help
Hall of Hacks
  • Education
    • Cyber Decoded
    • Definitions
  • Information
    • Alerts
    • Incidents
    • News
  • Insights
    • Cyber Hygiene
    • Cyber Review
    • Tips
    • Tutorials
  • Support
    • Contact Us
    • Report an incident
  • About
    • About Us
    • Advertise with us
Get Help
No Result
View All Result
Hall of Hacks
CyberMaterial
No Result
View All Result
Home News

APT29 Linked to Cyber Espionage Against NATO

April 14, 2023
Reading Time: 2 mins read
in News

 

Poland’s Military Counterintelligence Service and its Computer Emergency Response Team have linked APT29, a state-sponsored hacking group belonging to the Russian government’s Foreign Intelligence Service (SVR), to widespread attacks on NATO and European Union countries.

The group, also known as Cozy Bear and Nobelium, targeted diplomatic entities and foreign ministries in a cyber espionage campaign aimed at harvesting information. The attackers used spear-phishing emails impersonating European embassies, using malicious websites or attachments to deploy malware via ISO, IMG, and ZIP files.

Websites controlled by APT29 infected victims with the EnvyScout dropper via HTML smuggling, which helped deploy downloaders known as SNOWYAMBER and QUARTERRIG, designed to deliver additional malware, as well as a CobaltStrike Beacon stager named HALFRIG.

The malware analysis report revealed that SNOWYAMBER and QUARTERRIG were used for reconnaissance to evaluate each target’s relevance and determine whether they compromised honeypots or VMs used for malware analysis.

Once a workstation was infected, the downloaders were used to deliver and start-up the commercial tools COBALT STRIKE or BRUTE RATEL. HALFRIG was used as a loader that contained the COBALT STRIKE payload and ran it automatically.

APT29 is a hacking division of the Russian Foreign Intelligence Service (SVR), which was also linked to the SolarWinds supply-chain attack that led to the compromise of multiple US federal agencies three years ago. The group has breached other organizations’ networks using stealthy malware that remained undetected for years, including a new malware tracked as TrailBlazer and a variant of the GoldMax Linux backdoor.

In addition, the Brute Ratel adversarial attack simulation tool has been used in attacks suspected to be linked to the Russian SVR cyber spies. Microsoft recently reported that the APT29 hackers are using new malware capable of hijacking Active Directory Federation Services (ADFS) to log in as anyone in Windows systems.

The group has also orchestrated a wave of phishing campaigns targeting governments, embassies, and high-ranking officials across Europe.

Reference:
  • Espionage campaign linked to Russian intelligence services

Tags: April 2023APT29Cyber AttacksCyber NewsCyber News 2023EuropeGovernmentNATOPolandRussiaVulnerabilities
ADVERTISEMENT

Related Posts

US House Bans WhatsApp From Staff Devices

US House Bans WhatsApp From Staff Devices

June 24, 2025
UK Needs More Cyber Advisors For Small Firms

UK Needs More Cyber Advisors For Small Firms

June 24, 2025
OWASP Releases New AI Security Test Guide

OWASP Releases New AI Security Test Guide

June 24, 2025
Cloudflare Blocks Record 7.3 Tbps DDoS

US Expects Iranian Cyberattacks to Escalate

June 23, 2025
Cloudflare Blocks Record 7.3 Tbps DDoS

AT&T to Pay $177M for Massive Data Breach

June 23, 2025
Cloudflare Blocks Record 7.3 Tbps DDoS

Cloudflare Blocks Record 7.3 Tbps DDoS

June 23, 2025

Latest Alerts

Chinese Hackers Build Router Spy Network

New Malware Skims WordPress E-commerce Sites

BEARDSHELL and COVENANT Malware Uncovered

Prometei Botnet Attacks Servers for Crypto

Spyware in App Stores Steals Your Photos

Stealth Malware Targets Fortinet Firewalls

Subscribe to our newsletter

    Latest Incidents

    Hacken Token Crashes 99 Percent After Hack

    Paraguayan Government Hit By Cyberattack

    Hackers Leak Saudi Games Athlete Data

    Aflac Hacked in Spree on Insurance Firms

    CoinMarketCap Doodle Hack Steals Crypto

    UK’s Oxford Council Legacy Systems Breached

    CyberMaterial Logo
    • About Us
    • Contact Us
    • Jobs
    • Legal and Privacy Policy
    • Site Map

    © 2025 | CyberMaterial | All rights reserved

    Welcome Back!

    Login to your account below

    Forgotten Password?

    Retrieve your password

    Please enter your username or email address to reset your password.

    Log In

    Add New Playlist

    No Result
    View All Result
    • Alerts
    • Incidents
    • News
    • Cyber Decoded
    • Cyber Hygiene
    • Cyber Review
    • Definitions
    • Malware
    • Cyber Tips
    • Tutorials
    • Advanced Persistent Threats
    • Threat Actors
    • Report an incident
    • Password Generator
    • About Us
    • Contact Us
    • Advertise with us

    Copyright © 2025 CyberMaterial