Microsoft Discovers Russian Cyber Spy Operation

Uploaded on 2025-08-04 in FREE TO VIEW

A Russian government backed hacking group has been using cyber-espionage operations to hit foreign embassies and diplomats in Moscow.

This has been uncovered by Microsoft’s Threat Intelligence team, who published a report on July 31.

The group behind the campaign is called Secret Blizzard, or Turla, Waterbug, or Venomous Bear and is thought to be connected to Unit 16 of Russia’s FSB, the country’s main security agency.

Secret Blizzard has been orchestrating a cyber-espionage campaign since 2024, homing in on diplomats in Moscow with advanced tactics.

According to Microsoft, Secret Blizzard has been infecting devices that connect to Russian Internet service providers with a sophisticated malware strain dubbed ApolloShadow.

The malware disguises itself as legitimate antivirus software, but in reality, it enables hackers to gain deep access to sensitive information on compromised devices.

ApolloShadow’s Capabilities are Extensive

It can install fake root certificates, allowing the interception and modification of even encrypted Internet traffic.

The malware can also harvest login credentials, authentication tokens, and other vital information while creating hidden administrator-level accounts to maintain persistent access.

By leveraging its privileged access through Russian ISPs, the group can monitor nearly all online activity within diplomatic missions, including private communications and classified documents related to international negotiations.

“This campaign marks the first known case where hackers have used state-sanctioned access to Internet providers to launch cyberattacks,” Microsoft said in its report.

Recently, authorities in Russia’s Krasnoyarsk region have imposed restrictions on mobile Internet access and the Governor Mikhail Kotyukov has confirmed the measures.

When embassies are targeted by cyber attacks, the fallout goes well beyond national security.

These threats complicate international relations, prompting businesses and governments to rethink security strategies, cross-border communications, and even how they choose digital partners.

If you like this website and use the comprehensive 7,000-plus service supplier Directory, you can get unrestricted access, including the exclusive in-depth Directors Report series, by signing up for a Premium Subscription.