Menu

  • Alerts
  • Incidents
  • News
  • APTs
  • Cyber Decoded
  • Cyber Hygiene
  • Cyber Review
  • Cyber Tips
  • Definitions
  • Malware
  • Threat Actors
  • Tutorials

Useful Tools

  • Password generator
  • Report an incident
  • Report to authorities
No Result
View All Result
CTF Hack Havoc
CyberMaterial
  • Education
    • Cyber Decoded
    • Definitions
  • Information
    • Alerts
    • Incidents
    • News
  • Insights
    • Cyber Hygiene
    • Cyber Review
    • Tips
    • Tutorials
  • Support
    • Contact Us
    • Report an incident
  • About
    • About Us
    • Advertise with us
Get Help
Hall of Hacks
  • Education
    • Cyber Decoded
    • Definitions
  • Information
    • Alerts
    • Incidents
    • News
  • Insights
    • Cyber Hygiene
    • Cyber Review
    • Tips
    • Tutorials
  • Support
    • Contact Us
    • Report an incident
  • About
    • About Us
    • Advertise with us
Get Help
No Result
View All Result
Hall of Hacks
CyberMaterial
No Result
View All Result
Home News

APT29 Linked to Cyber Espionage Against NATO

April 14, 2023
Reading Time: 2 mins read
in News

 

Poland’s Military Counterintelligence Service and its Computer Emergency Response Team have linked APT29, a state-sponsored hacking group belonging to the Russian government’s Foreign Intelligence Service (SVR), to widespread attacks on NATO and European Union countries.

The group, also known as Cozy Bear and Nobelium, targeted diplomatic entities and foreign ministries in a cyber espionage campaign aimed at harvesting information. The attackers used spear-phishing emails impersonating European embassies, using malicious websites or attachments to deploy malware via ISO, IMG, and ZIP files.

Websites controlled by APT29 infected victims with the EnvyScout dropper via HTML smuggling, which helped deploy downloaders known as SNOWYAMBER and QUARTERRIG, designed to deliver additional malware, as well as a CobaltStrike Beacon stager named HALFRIG.

The malware analysis report revealed that SNOWYAMBER and QUARTERRIG were used for reconnaissance to evaluate each target’s relevance and determine whether they compromised honeypots or VMs used for malware analysis.

Once a workstation was infected, the downloaders were used to deliver and start-up the commercial tools COBALT STRIKE or BRUTE RATEL. HALFRIG was used as a loader that contained the COBALT STRIKE payload and ran it automatically.

APT29 is a hacking division of the Russian Foreign Intelligence Service (SVR), which was also linked to the SolarWinds supply-chain attack that led to the compromise of multiple US federal agencies three years ago. The group has breached other organizations’ networks using stealthy malware that remained undetected for years, including a new malware tracked as TrailBlazer and a variant of the GoldMax Linux backdoor.

In addition, the Brute Ratel adversarial attack simulation tool has been used in attacks suspected to be linked to the Russian SVR cyber spies. Microsoft recently reported that the APT29 hackers are using new malware capable of hijacking Active Directory Federation Services (ADFS) to log in as anyone in Windows systems.

The group has also orchestrated a wave of phishing campaigns targeting governments, embassies, and high-ranking officials across Europe.

Reference:
  • Espionage campaign linked to Russian intelligence services

Tags: April 2023APT29Cyber AttacksCyber NewsCyber News 2023EuropeGovernmentNATOPolandRussiaVulnerabilities
ADVERTISEMENT

Related Posts

SAP S4hana Exploited Vulnerability

US Allies Push For Sboms In Security

September 5, 2025
SAP S4hana Exploited Vulnerability

Reward For Russian FSB Hackers

September 5, 2025
SAP S4hana Exploited Vulnerability

US Sues Robot Toy Maker Over Data

September 5, 2025
Google Fined For Cookie Violations

Google Fined For Cookie Violations

September 4, 2025
Google Fined For Cookie Violations

Youtube Cracks Down On Password Sharing

September 4, 2025
Google Fined For Cookie Violations

Moscow Hires Hackers Behind School Breach

September 4, 2025

Latest Alerts

SAP S4hana Exploited Vulnerability

Virustotal Finds Undetected SVG Files

Russian APT28 Deploys Outlook Backdoor

CISA Flags TP Link Router Flaws

Lazarus Hackers Exploit ZeroDay, Deploy Rats

Google Patches 120 Flaws In Android

Subscribe to our newsletter

    Latest Incidents

    North Korean Hackers Fake Interviews

    Bridgestone Confirms Cyberattack

    Cybersecurity Firms Hit By Breach

    Salesloft Drift Attacks Hits Vendors

    Jaguar Land Rover Hit By Cyber Incident

    Hackers Use Grok Ai To Spread Malware

    CyberMaterial Logo
    • About Us
    • Contact Us
    • Jobs
    • Legal and Privacy Policy
    • Site Map

    © 2025 | CyberMaterial | All rights reserved

    Welcome Back!

    Login to your account below

    Forgotten Password?

    Retrieve your password

    Please enter your username or email address to reset your password.

    Log In

    Add New Playlist

    No Result
    View All Result
    • Alerts
    • Incidents
    • News
    • Cyber Decoded
    • Cyber Hygiene
    • Cyber Review
    • Definitions
    • Malware
    • Cyber Tips
    • Tutorials
    • Advanced Persistent Threats
    • Threat Actors
    • Report an incident
    • Password Generator
    • About Us
    • Contact Us
    • Advertise with us

    Copyright © 2025 CyberMaterial