Russians lure European diplomats into malware trap with wine-tasting invite
(2025/04/16)
- Reference: 1744806549
- News link: https://www.theregister.co.uk/2025/04/16/cozy_bear_grapeloader/
- Source link:
Russia never stops using proven tactics, and its Cozy Bear, aka APT 29, cyber-spies are once again trying to lure European diplomats into downloading malware with a phony invitation to a lux event.
Last year, the Kremlin team went after German politicians with Windows backdoor malware [1]dubbed Wineloader concealed in fake invitations to a dinner reception. Now, malware hunters at Check Point say the same crew is back with Grapeloader, and instead of supper, the Russians are luring Euro diplomats with an invitation to wine tasting.
Offers to attend the swish gathering arrive in an email disguised to resemble a missive from an unnamed European country's Ministry of Foreign Affairs and were sent to diplomats across the continent. If the targets failed to respond, the scammers sent follow up emails. Subject lines included "Wine tasting event (update date)," "For Ambassador’s Calendar," and "Diplomatic dinner." The message itself has a link to a download from a remote server that really shouldn't be clicked on.
[2]
"The server hosting the link is believed to be highly protected against scanning and automated analysis solutions, with the malicious download triggered only under certain conditions, such as specific times or geographic locations," the team at Check Point [3]reported Tuesday.
[4]
[5]
If a user meets the attackers’ criteria, clicking the invitation link downloads an archive called wine.zip. On other occasions the link directs the recipient to a legitimate page on the website of the embassy that supposedly sent the message.
The wine.zip archive carries three files:
A legitimate PowerPoint executable, wine.exe, which is exploited for DLL side-loading.
A hidden DLL, AppvIsvSubsystems64.dll, which is bloated with junk code, serving only as a required dependency for the PowerPoint executable to run.
Another hidden and heavily obfuscated DLL, ppcore.dll, that functions as a loader, called Grapeloader, as it is likely used to deliver Wineloader in later phases of the attack.
Grapeloader copies the contents of the archive onto a victim PC's hard drive and changes the Windows Registry’s Run key to ensure persistence. It scans for information, including usernames, the computer name, process names, and process identifiers, and pings a Cozy Bear command-and-control server every 60 seconds for instructions to carry out and seemingly to take delivery of an updated version of Wineloader to run.
[6]If you dread a Microsoft Teams invite, just wait until it turns out to be a Russian phish
[7]Russian spies use remote desktop protocol files in unusual mass phishing drive
[8]What a coincidence. Spyware makers, Russia's Cozy Bear seem to share same exploits
[9]US Cyber Command reportedly pauses cyberattacks on Russia
The new vintage of Wineloader is a 64-bit trojanized DLL file that allows data to be harvested from the infected machine, encrypted using RC4, and sent back to the command-and-control server. It's much better at deleting signs of presence in memory and using junk code to hide its true nature from malware-hunting applications.
Check Point’s analysis of the new Wineloader code and its targets led the outfit to conclude that Russia’s government and Cozy Bear, one of Moscow’s most potent and prolific cyber-snoop crews, is almost certainly behind the backdoor malware. The group was behind the massive 2020 [10]SolarWinds hack and is thought to be one of the squads run by the FSB, Russia's primary intelligence agency.
[11]
Cozy Bear has a long history that started in the late Naughts when it developed malware to assist spying efforts. The crew later moved onto organized campaigns against specific targets, such as the [12]Democratic National Committee , the US State Department, and the White House before the USA’s 2016 national election. The gang was exposed when Dutch government whiz-kids managed to [13]break into the crew's security cameras and observe them at work.
Nowadays, Cozy collects whatever the Kremlin wants from Western governments and their allies - even going after COVID-19 vaccine development data during the pandemic. Presumably, the crew decided that luring diplomats with a party worked so well last time, it was time to tweak things and try again. ®
Get our [14]Tech Resources
[1] https://www.theregister.com/2024/03/23/russia_cozy_bear_german_politicians_phishing/
[2] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/cybercrime&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2Z__UHwBpX0ATvI-CtBmn8QAAAMo&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0
[3] https://research.checkpoint.com/2025/apt29-phishing-campaign/
[4] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/cybercrime&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44Z__UHwBpX0ATvI-CtBmn8QAAAMo&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[5] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/cybercrime&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33Z__UHwBpX0ATvI-CtBmn8QAAAMo&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[6] https://www.theregister.com/2025/02/15/russia_spies_spoofing_teams/
[7] https://www.theregister.com/2024/10/30/russia_wrangles_rdp_files_in/
[8] https://www.theregister.com/2024/08/29/commercial_spyware_russia_mongolia/
[9] https://www.theregister.com/2025/03/03/infosec_in_brief/
[10] https://www.theregister.com/2021/04/15/solarwinds_hack_russia_apt29_positive_technologies_sanctions/
[11] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/cybercrime&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44Z__UHwBpX0ATvI-CtBmn8QAAAMo&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[12] https://www.theregister.com/2016/06/14/russian_government_hackers_spent_year_in_dnc_servers/
[13] https://www.theregister.com/2018/01/26/tech_russia_source_code_dnc_hack/
[14] https://whitepapers.theregister.com/
Last year, the Kremlin team went after German politicians with Windows backdoor malware [1]dubbed Wineloader concealed in fake invitations to a dinner reception. Now, malware hunters at Check Point say the same crew is back with Grapeloader, and instead of supper, the Russians are luring Euro diplomats with an invitation to wine tasting.
Offers to attend the swish gathering arrive in an email disguised to resemble a missive from an unnamed European country's Ministry of Foreign Affairs and were sent to diplomats across the continent. If the targets failed to respond, the scammers sent follow up emails. Subject lines included "Wine tasting event (update date)," "For Ambassador’s Calendar," and "Diplomatic dinner." The message itself has a link to a download from a remote server that really shouldn't be clicked on.
[2]
"The server hosting the link is believed to be highly protected against scanning and automated analysis solutions, with the malicious download triggered only under certain conditions, such as specific times or geographic locations," the team at Check Point [3]reported Tuesday.
[4]
[5]
If a user meets the attackers’ criteria, clicking the invitation link downloads an archive called wine.zip. On other occasions the link directs the recipient to a legitimate page on the website of the embassy that supposedly sent the message.
The wine.zip archive carries three files:
A legitimate PowerPoint executable, wine.exe, which is exploited for DLL side-loading.
A hidden DLL, AppvIsvSubsystems64.dll, which is bloated with junk code, serving only as a required dependency for the PowerPoint executable to run.
Another hidden and heavily obfuscated DLL, ppcore.dll, that functions as a loader, called Grapeloader, as it is likely used to deliver Wineloader in later phases of the attack.
Grapeloader copies the contents of the archive onto a victim PC's hard drive and changes the Windows Registry’s Run key to ensure persistence. It scans for information, including usernames, the computer name, process names, and process identifiers, and pings a Cozy Bear command-and-control server every 60 seconds for instructions to carry out and seemingly to take delivery of an updated version of Wineloader to run.
[6]If you dread a Microsoft Teams invite, just wait until it turns out to be a Russian phish
[7]Russian spies use remote desktop protocol files in unusual mass phishing drive
[8]What a coincidence. Spyware makers, Russia's Cozy Bear seem to share same exploits
[9]US Cyber Command reportedly pauses cyberattacks on Russia
The new vintage of Wineloader is a 64-bit trojanized DLL file that allows data to be harvested from the infected machine, encrypted using RC4, and sent back to the command-and-control server. It's much better at deleting signs of presence in memory and using junk code to hide its true nature from malware-hunting applications.
Check Point’s analysis of the new Wineloader code and its targets led the outfit to conclude that Russia’s government and Cozy Bear, one of Moscow’s most potent and prolific cyber-snoop crews, is almost certainly behind the backdoor malware. The group was behind the massive 2020 [10]SolarWinds hack and is thought to be one of the squads run by the FSB, Russia's primary intelligence agency.
[11]
Cozy Bear has a long history that started in the late Naughts when it developed malware to assist spying efforts. The crew later moved onto organized campaigns against specific targets, such as the [12]Democratic National Committee , the US State Department, and the White House before the USA’s 2016 national election. The gang was exposed when Dutch government whiz-kids managed to [13]break into the crew's security cameras and observe them at work.
Nowadays, Cozy collects whatever the Kremlin wants from Western governments and their allies - even going after COVID-19 vaccine development data during the pandemic. Presumably, the crew decided that luring diplomats with a party worked so well last time, it was time to tweak things and try again. ®
Get our [14]Tech Resources
[1] https://www.theregister.com/2024/03/23/russia_cozy_bear_german_politicians_phishing/
[2] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/cybercrime&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2Z__UHwBpX0ATvI-CtBmn8QAAAMo&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0
[3] https://research.checkpoint.com/2025/apt29-phishing-campaign/
[4] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/cybercrime&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44Z__UHwBpX0ATvI-CtBmn8QAAAMo&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[5] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/cybercrime&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33Z__UHwBpX0ATvI-CtBmn8QAAAMo&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[6] https://www.theregister.com/2025/02/15/russia_spies_spoofing_teams/
[7] https://www.theregister.com/2024/10/30/russia_wrangles_rdp_files_in/
[8] https://www.theregister.com/2024/08/29/commercial_spyware_russia_mongolia/
[9] https://www.theregister.com/2025/03/03/infosec_in_brief/
[10] https://www.theregister.com/2021/04/15/solarwinds_hack_russia_apt29_positive_technologies_sanctions/
[11] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/cybercrime&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44Z__UHwBpX0ATvI-CtBmn8QAAAMo&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[12] https://www.theregister.com/2016/06/14/russian_government_hackers_spent_year_in_dnc_servers/
[13] https://www.theregister.com/2018/01/26/tech_russia_source_code_dnc_hack/
[14] https://whitepapers.theregister.com/
Re: Ported
ecofeco
Well played.
Re: Ported
Doctor Syntax
A full-bodied red but the bitter after-taste makes it unacceptable.
We can make fun of the victims...
Anonymous Coward
... but the miscreants would come up with something we would fall for.
The lessons anyone who studies scammers, scams, and heists learns is that nobody is safe. Everybody can be scammed or fall for an elaborate heist.
The other lesson from the cyber security crowed is that if your company/network/computer is p0wnd when you click a link, then your security has bigger problems than a user that clicks the wrong link.
Because, clicking links is basically what you have a computer for.
A legitimate PowerPoint executable, wine.exe
Paul Crawford
There is so much wrong with that statement, and once again makes me glad not to be using Windows for my main computer...
Just wine?
I ain't Spartacus
I'm disappointed there isn't an executable called "Cheese", to go with it...
Re: Just wine?
Doctor Syntax
The victims are cheesed off.
Examine the goddamm headers!
Mike 137
" email disguised to resemble a missive from an unnamed European country's Ministry of Foreign Affairs "
Whether the sender is legitimate should be determinable from the email headers, particularly in the context of diplomatic traffic, which by definition has a limited circulation.
Re: Examine the goddamm headers!
Doctor Syntax
The Foreign Affairs also have a limited circulation.
On a more serious note, the people who are going to click on such links aren't going to check the headers.
Ported
to a new platform.