Menu

  • Alerts
  • Incidents
  • News
  • APTs
  • Cyber Decoded
  • Cyber Hygiene
  • Cyber Review
  • Cyber Tips
  • Definitions
  • Malware
  • Threat Actors
  • Tutorials

Useful Tools

  • Password generator
  • Report an incident
  • Report to authorities
No Result
View All Result
CTF Hack Havoc
CyberMaterial
  • Education
    • Cyber Decoded
    • Definitions
  • Information
    • Alerts
    • Incidents
    • News
  • Insights
    • Cyber Hygiene
    • Cyber Review
    • Tips
    • Tutorials
  • Support
    • Contact Us
    • Report an incident
  • About
    • About Us
    • Advertise with us
Get Help
Hall of Hacks
  • Education
    • Cyber Decoded
    • Definitions
  • Information
    • Alerts
    • Incidents
    • News
  • Insights
    • Cyber Hygiene
    • Cyber Review
    • Tips
    • Tutorials
  • Support
    • Contact Us
    • Report an incident
  • About
    • About Us
    • Advertise with us
Get Help
No Result
View All Result
Hall of Hacks
CyberMaterial
No Result
View All Result
Home News

APT29 Linked to Cyber Espionage Against NATO

April 14, 2023
Reading Time: 2 mins read
in News

 

Poland’s Military Counterintelligence Service and its Computer Emergency Response Team have linked APT29, a state-sponsored hacking group belonging to the Russian government’s Foreign Intelligence Service (SVR), to widespread attacks on NATO and European Union countries.

The group, also known as Cozy Bear and Nobelium, targeted diplomatic entities and foreign ministries in a cyber espionage campaign aimed at harvesting information. The attackers used spear-phishing emails impersonating European embassies, using malicious websites or attachments to deploy malware via ISO, IMG, and ZIP files.

Websites controlled by APT29 infected victims with the EnvyScout dropper via HTML smuggling, which helped deploy downloaders known as SNOWYAMBER and QUARTERRIG, designed to deliver additional malware, as well as a CobaltStrike Beacon stager named HALFRIG.

The malware analysis report revealed that SNOWYAMBER and QUARTERRIG were used for reconnaissance to evaluate each target’s relevance and determine whether they compromised honeypots or VMs used for malware analysis.

Once a workstation was infected, the downloaders were used to deliver and start-up the commercial tools COBALT STRIKE or BRUTE RATEL. HALFRIG was used as a loader that contained the COBALT STRIKE payload and ran it automatically.

APT29 is a hacking division of the Russian Foreign Intelligence Service (SVR), which was also linked to the SolarWinds supply-chain attack that led to the compromise of multiple US federal agencies three years ago. The group has breached other organizations’ networks using stealthy malware that remained undetected for years, including a new malware tracked as TrailBlazer and a variant of the GoldMax Linux backdoor.

In addition, the Brute Ratel adversarial attack simulation tool has been used in attacks suspected to be linked to the Russian SVR cyber spies. Microsoft recently reported that the APT29 hackers are using new malware capable of hijacking Active Directory Federation Services (ADFS) to log in as anyone in Windows systems.

The group has also orchestrated a wave of phishing campaigns targeting governments, embassies, and high-ranking officials across Europe.

Reference:
  • Espionage campaign linked to Russian intelligence services

Tags: April 2023APT29Cyber AttacksCyber NewsCyber News 2023EuropeGovernmentNATOPolandRussiaVulnerabilities
ADVERTISEMENT

Related Posts

Smart Bus Flaws Allow Spying, Control

DOJ Disrupts BlackSuit Ransomware Ops

August 13, 2025
Smart Bus Flaws Allow Spying, Control

Wikipedia Loses UK Online Safety Act Case

August 13, 2025
Smart Bus Flaws Allow Spying, Control

Reddit Blocks Internet Archive Over AI Scraping

August 13, 2025
Chrome Sandbox Escape Earns $250K

Embargo Gang Made $34M in a Year

August 12, 2025
Chrome Sandbox Escape Earns $250K

Chrome Sandbox Escape Earns $250K

August 12, 2025
Chrome Sandbox Escape Earns $250K

Privacy Watchdog Sues Optus Over Breach

August 12, 2025

Latest Alerts

Smart Bus Flaws Allow Spying, Control

Fortinet SSL VPNs hit, then FortiManager targeted

Ukrainian Web3team Targets Job Seekers

Win-DDoS Flaws Enable DC DDoS Botnets

GPT-5 Jailbreak, Zero-Click AI Threats

7-Zip Flaw Enables Arbitrary Code Run

Subscribe to our newsletter

    Latest Incidents

    Pennsylvania AG Systems Down

    WestJet Confirms June 2025 Data Breach

    EPEC Hacked Social Media

    Columbia Data Breach Hits 900K

    Chinese Gang Hits 115M US Payment Cards

    Yes24 Down After Cyberattack

    CyberMaterial Logo
    • About Us
    • Contact Us
    • Jobs
    • Legal and Privacy Policy
    • Site Map

    © 2025 | CyberMaterial | All rights reserved

    Welcome Back!

    Login to your account below

    Forgotten Password?

    Retrieve your password

    Please enter your username or email address to reset your password.

    Log In

    Add New Playlist

    No Result
    View All Result
    • Alerts
    • Incidents
    • News
    • Cyber Decoded
    • Cyber Hygiene
    • Cyber Review
    • Definitions
    • Malware
    • Cyber Tips
    • Tutorials
    • Advanced Persistent Threats
    • Threat Actors
    • Report an incident
    • Password Generator
    • About Us
    • Contact Us
    • Advertise with us

    Copyright © 2025 CyberMaterial