Full Report
In a warning to foreign embassies in Moscow, Microsoft said a Russian state-backed hacking group known as Secret Blizzard or Turla has been using internet service providers for adversary-in-the-middle (AiTM) attacks.
Analysis Summary
# Threat Actor: Secret Blizzard (Turla)
## Attribution & Identity
* **Identified by:** Microsoft research.
* **Attribution:** Believed to be housed within Center 16 of the Russian Federal Security Service (FSB).
* **Known Aliases:** Turla.
## Activity Summary
The ongoing cyber-espionage campaign has been active since at least 2024, focusing on installing malware by exploiting control over local Internet Service Providers (ISPs) in Moscow. This represents the first time Secret Blizzard has confirmed the capability to conduct espionage activities at the ISP level. The group uses an Adversary-in-the-Middle (AiTM) technique to deploy malware, allowing them to collect intelligence and maintain access to target systems. They are known for stealing politically significant information, especially advanced research that might influence international political issues, and have been heavily involved in Russia’s war against Ukraine. In a similar past campaign (attributed to Belarusian actors, but linked to Secret Blizzard/Turla), foreign ministries in Eastern Europe were infected via trojanized Flash installers distributed through AiTM positions.
## Tactics, Techniques & Procedures
* **AiTM Deployment:** Using techniques to position themselves between networks (likely leveraging Russia's SORM lawful intercept systems) to facilitate access to foreign embassy systems.
* **Captive Portals:** Redirecting target devices behind captive portals that lead to separate domains controlled by the actor.
* **Malware Installation:** Prompting users to unknowingly download malware disguised as legitimate installers (e.g., a Kaspersky antivirus installer).
* **Privilege Escalation:** Using the installed malware to gain elevated privileges on the system.
* **Firewall Modification:** Relaxing firewall rules to enable file sharing and potentially ease lateral movement.
* **Trojans/Installers:** Utilizing trojanized software installers.
* **MITRE ATT&CK (Inferred from activity):** T1557 (Adversary-in-the-Middle), T1566.002 (Spearphishing Link - indirectly via compromised redirection), T1053 (Scheduled Task/Job - *implied by persistent access*).
## Targeting
* **Sectors:** Foreign embassies, diplomatic entities, foreign ministries, government offices, and defense departments.
* **Geography:** Moscow, Russia (targeting entities operating there). Also historically targeted Eastern Europe.
* **Victims:** Foreign embassies relying on local internet providers in Moscow. Mention of potential linkage to sensitive communications involving former U.S. envoy Steve Witkoff during a visit to Moscow.
## Tools & Infrastructure
* **Malware families used:** ApolloShadow, Witkoff (mentioned in context of a victim/event, not explicitly a malware), Belarus (mentioned in context of a similar campaign).
* **Infrastructure (C2, domains, IPs):** Deployed malicious domains used for redirection via captive portals.
* **Enabling Technology:** Likely leverages Russia’s System for Operative Investigative Activities (SORM) for AiTM activity.
## Implications
This campaign signifies a dangerous evolution in state-sponsored espionage by "collapsing the boundary between ‘passive surveillance’ and ‘active intrusion.’" By integrating offensive operations directly into the ISP/telecom infrastructure, Secret Blizzard can actively modify network traffic to gain a foothold on targeted systems, posing a significant risk to any diplomatic or government personnel operating within Russia's borders. Other countries with state-aligned telecom access (e.g., China, Iran, North Korea) may adopt similar AiTM tradecraft.
## Mitigations
* Organizations operating in Russia should use a **Virtual Private Network (VPN)** service provider.
* Route all traffic through **encrypted tunnels** to trusted networks or alternative providers.