Do Son A Russian APT is targeting Transnistria and NATO entities using blurred HTML attachments to harvest credentials. The 2025 campaign mimics official presidential decrees.
Russian APT
Volexity exposed Russian APT UTA0355 using fake security conference sites and WhatsApp support to trick victims. The attacks steal Microsoft 365 OAuth and Device Code tokens for persistent access.
Sekoia exposed Russian Calisto APT (FSB-linked) targeting RSF and NGOs with spear-phishing. The attack uses a custom AiTM kit and a "missing file" lure to steal credentials and 2FA codes.
Bitdefender exposed Curly COMrades (Russian APT) using Hyper-V to run a hidden Alpine Linux VM. The VM hosts the CurlyShell backdoor, effectively bypassing host-based EDR for espionage.
Google exposed Russia's COLDRIVER APT deploying a new "ROBOT" malware family (NOROBOT, YESROBOT) just 5 days after its LOSTKEYS tool was disclosed. The multi-stage malware uses a ClickFix lure.
Proofpoint reveals two Russian threat clusters (TA829 & UNK_GreenSec) blending financial cybercrime with state-aligned espionage, using RomCom and TransferLoader malware.
A Russian state-sponsored APT, UNC6293 (likely APT29), is exploiting Google Application-Specific Passwords in a sophisticated phishing campaign targeting critics of Russia
Microsoft identified Void Blizzard, a new Russia-affiliated cyberespionage group, targeting critical sectors in NATO countries and Ukraine.
Volexity uncovers Russian threat actors abusing Microsoft 365 OAuth flows via phishing, impersonation, and device registration to access email accounts.
2023 witnessed a significant shift in the tactics and approaches of cyber attackers, influenced by global conflicts and advancements in technology