Do Son APT29, a Russia-linked group, targets European diplomats with phishing emails disguised as wine tasting invitations, deploying GRAPELOADER malware
WINELOADER
A detailed analysis by the Splunk Threat Research Team reveals a multi-pronged attack and the use of a new backdoor malware called ‘WINELOADER’
The employment of WINELOADER, endowed with features overlapping with other APT29 malware families such as BURNTBATTER and MUSKYBEAT
Central to the Spiked Wine threat actor campaign is WINELOADER, a modular backdoor engineered with evasion and stealth in mind