Russia-linked APT29 targets European diplomats with new malware

Cyberespionage group known as APT29 and linked to Russia’s foreign intelligence service (SVR), has added a new malware loader to its toolset. Used for fingerprinting, persistence and payload delivery, the new loader was observed in a recent phishing campaign against diplomatic missions in Europe.

“In this current wave of attacks, the threat actors impersonate a major European Ministry of Foreign Affairs to send out invitations to wine tasting events, prompting targets to click a web link leading to the deployment of a new backdoor called GRAPELOADER,” researchers from security firm Check Point wrote in a report. “This campaign appears to be focused on targeting European diplomatic entities, including non-European countries’ embassies located in Europe.”

APT29, also known as Cozy Bear and Midnight Blizzard, is one of the most sophisticated Russian state-sponsored cyberespionage groups. Because of its links to the SVR, its phishing targets are often diplomatic missions, government entities, political parties and think tanks. However, the group is also capable of launching software supply chain attacks, being responsible for the 2020 attack on SolarWinds that impacted thousands of companies, organizations and government agencies.