Menu

  • Alerts
  • Incidents
  • News
  • APTs
  • Cyber Decoded
  • Cyber Hygiene
  • Cyber Review
  • Cyber Tips
  • Definitions
  • Malware
  • Threat Actors
  • Tutorials

Useful Tools

  • Password generator
  • Report an incident
  • Report to authorities
No Result
View All Result
CTF Hack Havoc
CyberMaterial
  • Education
    • Cyber Decoded
    • Definitions
  • Information
    • Alerts
    • Incidents
    • News
  • Insights
    • Cyber Hygiene
    • Cyber Review
    • Tips
    • Tutorials
  • Support
    • Contact Us
    • Report an incident
  • About
    • About Us
    • Advertise with us
Get Help
Hall of Hacks
  • Education
    • Cyber Decoded
    • Definitions
  • Information
    • Alerts
    • Incidents
    • News
  • Insights
    • Cyber Hygiene
    • Cyber Review
    • Tips
    • Tutorials
  • Support
    • Contact Us
    • Report an incident
  • About
    • About Us
    • Advertise with us
Get Help
No Result
View All Result
Hall of Hacks
CyberMaterial
No Result
View All Result
Home News

APT29 Linked to Cyber Espionage Against NATO

April 14, 2023
Reading Time: 2 mins read
in News

 

Poland’s Military Counterintelligence Service and its Computer Emergency Response Team have linked APT29, a state-sponsored hacking group belonging to the Russian government’s Foreign Intelligence Service (SVR), to widespread attacks on NATO and European Union countries.

The group, also known as Cozy Bear and Nobelium, targeted diplomatic entities and foreign ministries in a cyber espionage campaign aimed at harvesting information. The attackers used spear-phishing emails impersonating European embassies, using malicious websites or attachments to deploy malware via ISO, IMG, and ZIP files.

Websites controlled by APT29 infected victims with the EnvyScout dropper via HTML smuggling, which helped deploy downloaders known as SNOWYAMBER and QUARTERRIG, designed to deliver additional malware, as well as a CobaltStrike Beacon stager named HALFRIG.

The malware analysis report revealed that SNOWYAMBER and QUARTERRIG were used for reconnaissance to evaluate each target’s relevance and determine whether they compromised honeypots or VMs used for malware analysis.

Once a workstation was infected, the downloaders were used to deliver and start-up the commercial tools COBALT STRIKE or BRUTE RATEL. HALFRIG was used as a loader that contained the COBALT STRIKE payload and ran it automatically.

APT29 is a hacking division of the Russian Foreign Intelligence Service (SVR), which was also linked to the SolarWinds supply-chain attack that led to the compromise of multiple US federal agencies three years ago. The group has breached other organizations’ networks using stealthy malware that remained undetected for years, including a new malware tracked as TrailBlazer and a variant of the GoldMax Linux backdoor.

In addition, the Brute Ratel adversarial attack simulation tool has been used in attacks suspected to be linked to the Russian SVR cyber spies. Microsoft recently reported that the APT29 hackers are using new malware capable of hijacking Active Directory Federation Services (ADFS) to log in as anyone in Windows systems.

The group has also orchestrated a wave of phishing campaigns targeting governments, embassies, and high-ranking officials across Europe.

Reference:
  • Espionage campaign linked to Russian intelligence services

Tags: April 2023APT29Cyber AttacksCyber NewsCyber News 2023EuropeGovernmentNATOPolandRussiaVulnerabilities
ADVERTISEMENT

Related Posts

Cloudflare Mitigates 22Tbps DDoS Attack

Secret Service Dismantles UN Telecom Threat

September 24, 2025
Cloudflare Mitigates 22Tbps DDoS Attack

Firefox Lets Devs Roll Back Bad Updates

September 24, 2025
Cloudflare Mitigates 22Tbps DDoS Attack

Cloudflare Mitigates 22Tbps DDoS Attack

September 24, 2025
TradeOgre Exchange Dismantled In Canada

TradeOgre Exchange Dismantled In Canada

September 22, 2025
TradeOgre Exchange Dismantled In Canada

Kremlin Hack Groups Team Up ESET Says

September 22, 2025
TradeOgre Exchange Dismantled In Canada

Qilin Still Top Ransomware Group Globally

September 22, 2025

Latest Alerts

Hackers Target AWS and Steal Credentials

SonicWall SMA100 Update Removes Rootkit

BadIIS Malware Spreads Via SEO Poisoning

SonicWall Warns Reset After Exposure

Infostealer Hits macOS Users Widely

FBI Issues Warning on Spoofed IC3 Website

Subscribe to our newsletter

    Latest Incidents

    Boyd Gaming Reports Data Breach After Attack

    Morrisroe UK Company Hit By Cyber Attack

    GeoServer Flaw Breaches US Agency Network

    Steam Game Steals Streamer Donations

    Ransomware Gang Hacks Spartanburg County

    Cyberattack Hits Europe Airport Systems

    CyberMaterial Logo
    • About Us
    • Contact Us
    • Jobs
    • Legal and Privacy Policy
    • Site Map

    © 2025 | CyberMaterial | All rights reserved

    Welcome Back!

    Login to your account below

    Forgotten Password?

    Retrieve your password

    Please enter your username or email address to reset your password.

    Log In

    Add New Playlist

    No Result
    View All Result
    • Alerts
    • Incidents
    • News
    • Cyber Decoded
    • Cyber Hygiene
    • Cyber Review
    • Definitions
    • Malware
    • Cyber Tips
    • Tutorials
    • Advanced Persistent Threats
    • Threat Actors
    • Report an incident
    • Password Generator
    • About Us
    • Contact Us
    • Advertise with us

    Copyright © 2025 CyberMaterial