Kremlin goons caught abusing ISPs to spy on Moscow-based diplomats, Microsoft says
(2025/07/31)
- Reference: 1753977611
- News link: https://www.theregister.co.uk/2025/07/31/kremlin_goons_caught_abusing_isps/
- Source link:
Russian cyberspies are abusing local internet service providers' networks to target foreign embassies in Moscow and collect intel from diplomats' devices, according to a Microsoft Threat Intelligence warning.
Redmond detailed the ongoing cyber-espionage campaign, active since at least 2024, and carried out by a Kremlin-backed group it tracks as Secret Blizzard (aka VENOMOUS BEAR, Turla, WRAITH, ATG26) in a Thursday report. Microsoft declined to say how many organizations were targeted, or successfully infected, in this campaign.
The threat hunters first observed one such Secret Blizzard snooping mission in February. Putin's spies, according to Microsoft, used an [1]adversary-in-the-middle (AiTM) position at the ISP/telco level to gain access to foreign embassies located in Moscow and deploy their custom ApolloShadow malware.
[2]
In an AiTM attack, the attacker intercepts communications between two parties, such as the victim's device and website they are trying to access. The attacker can then read messages and steal sensitive information like login credentials or financial account info. Or they can use this AiTM position to redirect users to fake websites or inject malicious code.
[3]
[4]
To achieve AiTM intrusions, the attacker usually creates a fake network with a similar name to one the victim is trying to connect to — for example, a phony airport Wi-Fi network that's just a letter or two off from the real thing.
But in this case, Secret Blizzard’s AiTM position at the ISP level "is likely facilitated by lawful intercept," the threat hunters noted.
[5]
The Register asked Microsoft if this means that the attackers have ISP consent to sit on the networks, intercept victims' communications, and push malware to their devices.
"We do not have insight into the relationship between the threat actor and the ISP. In certain geopolitical contexts, any ISP may not be acting independently," Microsoft Director Of Threat Intelligence Strategy Sherrod DeGrippo responded. "The takeaway here is for personnel with access to this level of sensitive data, networks used should be vetted and secured with end-to-end visibility."
The bottom line, she added, is that anyone sending and receiving super sensitive data should use thoroughly vetted networks that are secured with end-to-end visibility. "In a country where the government has deep technical and legal control over ISPs, that infrastructure can become part of the threat surface," DeGrippo said.
[6]
While Microsoft previously claimed that Secret Blizzard conducted snooping campaigns inside Russia against both foreign and domestic entities, "this is the first time we can confirm that they have the capability to do so at the Internet Service Provider (ISP) level," according to the report.
How the attack works
In the new campaign, Kremlin spies redirect target devices by putting them behind a captive portal: a legitimate web page that manages network access like those a user would see when connecting to the internet at an airport or hotel.
Once the victim's device is behind this captive portal, the attackers initiate the Windows Test Connectivity Status Indicator. This is a legitimate service that determines if a device has internet access by sending an HTTP GET request to hxxp://www.msftconnecttest[.]com/redirect, which should direct to msn[.]com.
In this attack, it redirects to a Secret Blizzard-controlled domain that likely displays a certificate validation error and gets the user to download and execute ApolloShadow. If the device isn't running on default admin settings, the user is presented with a pop-up window that tells them to download fake certificates, named CertificateDB[.]exe, which gives the attackers elevated privileges.
"We assess this allows for TLS/SSL stripping from the Secret Blizzard AiTM position, rendering the majority of the target's browsing in clear text including the delivery of certain tokens and credentials," Microsoft wrote.
[7]UK uncovers novel Microsoft snooping malware, blames and sanctions GRU cyberspies
[8]Russia, hotbed of cybercrime, says nyet to ethical hacking bill
[9]Russia's Fancy Bear swipes a paw at logistics, transport orgs' email servers
[10]Another massive security snafu hits Microsoft, but don't expect it to stick
Using their AiTM position, the Russian spies can use DNS manipulation to redirect communications to a Secret Blizzard-controlled command-and-control server, and then send the second-stage payload to the victim's device.
This one displays to the victim as a user account control (UAC) pop-up window asking permission to bypass UAC safety mechanisms. If the user clicks "yes," the malware now has the highest-available privileges, which ApolloShadow initially abuses by setting all networks to "private," allowing the host device to become discoverable, and changing firewall rules to enable file sharing.
"While we did not see any direct attempts for lateral movement, the main reason for these modifications is likely to reduce the difficulty of lateral movement on the network," Microsoft wrote.
Finally, ApolloShadow creates an administrative user with the username UpdatusUser and a hardcoded password, set to never expire, on the compromised system using the Windows API NetUserAdd. The malware now has persistent access to the infected host via the newly created local admin user.
To protect against Kremlin spies eavesdropping on devices, Microsoft recommends everyone operating in Moscow — especially sensitive organizations such as foreign embassies — to route all traffic through an encrypted tunnel to a trusted network, not a local ISP. Or, use a virtual private network (VPN) service provider like a satellite-based provider, whose infrastructure is not controlled by Russia or other outside entities. ®
Get our [11]Tech Resources
[1] https://attack.mitre.org/techniques/T1557/
[2] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2aIvnejAeBIxAZGLNCQT1swAAAEc&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0
[3] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44aIvnejAeBIxAZGLNCQT1swAAAEc&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[4] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33aIvnejAeBIxAZGLNCQT1swAAAEc&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[5] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44aIvnejAeBIxAZGLNCQT1swAAAEc&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[6] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33aIvnejAeBIxAZGLNCQT1swAAAEc&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[7] https://www.theregister.com/2025/07/20/uk_microsoft_snooping_russia/
[8] https://www.theregister.com/2025/07/10/russia_ethical_hacking_bill/
[9] https://www.theregister.com/2025/05/21/russias_fancy_bear_alert/
[10] https://www.theregister.com/2025/07/21/massive_security_snafu_microsoft/
[11] https://whitepapers.theregister.com/
Redmond detailed the ongoing cyber-espionage campaign, active since at least 2024, and carried out by a Kremlin-backed group it tracks as Secret Blizzard (aka VENOMOUS BEAR, Turla, WRAITH, ATG26) in a Thursday report. Microsoft declined to say how many organizations were targeted, or successfully infected, in this campaign.
The threat hunters first observed one such Secret Blizzard snooping mission in February. Putin's spies, according to Microsoft, used an [1]adversary-in-the-middle (AiTM) position at the ISP/telco level to gain access to foreign embassies located in Moscow and deploy their custom ApolloShadow malware.
[2]
In an AiTM attack, the attacker intercepts communications between two parties, such as the victim's device and website they are trying to access. The attacker can then read messages and steal sensitive information like login credentials or financial account info. Or they can use this AiTM position to redirect users to fake websites or inject malicious code.
[3]
[4]
To achieve AiTM intrusions, the attacker usually creates a fake network with a similar name to one the victim is trying to connect to — for example, a phony airport Wi-Fi network that's just a letter or two off from the real thing.
But in this case, Secret Blizzard’s AiTM position at the ISP level "is likely facilitated by lawful intercept," the threat hunters noted.
[5]
The Register asked Microsoft if this means that the attackers have ISP consent to sit on the networks, intercept victims' communications, and push malware to their devices.
"We do not have insight into the relationship between the threat actor and the ISP. In certain geopolitical contexts, any ISP may not be acting independently," Microsoft Director Of Threat Intelligence Strategy Sherrod DeGrippo responded. "The takeaway here is for personnel with access to this level of sensitive data, networks used should be vetted and secured with end-to-end visibility."
The bottom line, she added, is that anyone sending and receiving super sensitive data should use thoroughly vetted networks that are secured with end-to-end visibility. "In a country where the government has deep technical and legal control over ISPs, that infrastructure can become part of the threat surface," DeGrippo said.
[6]
While Microsoft previously claimed that Secret Blizzard conducted snooping campaigns inside Russia against both foreign and domestic entities, "this is the first time we can confirm that they have the capability to do so at the Internet Service Provider (ISP) level," according to the report.
How the attack works
In the new campaign, Kremlin spies redirect target devices by putting them behind a captive portal: a legitimate web page that manages network access like those a user would see when connecting to the internet at an airport or hotel.
Once the victim's device is behind this captive portal, the attackers initiate the Windows Test Connectivity Status Indicator. This is a legitimate service that determines if a device has internet access by sending an HTTP GET request to hxxp://www.msftconnecttest[.]com/redirect, which should direct to msn[.]com.
In this attack, it redirects to a Secret Blizzard-controlled domain that likely displays a certificate validation error and gets the user to download and execute ApolloShadow. If the device isn't running on default admin settings, the user is presented with a pop-up window that tells them to download fake certificates, named CertificateDB[.]exe, which gives the attackers elevated privileges.
"We assess this allows for TLS/SSL stripping from the Secret Blizzard AiTM position, rendering the majority of the target's browsing in clear text including the delivery of certain tokens and credentials," Microsoft wrote.
[7]UK uncovers novel Microsoft snooping malware, blames and sanctions GRU cyberspies
[8]Russia, hotbed of cybercrime, says nyet to ethical hacking bill
[9]Russia's Fancy Bear swipes a paw at logistics, transport orgs' email servers
[10]Another massive security snafu hits Microsoft, but don't expect it to stick
Using their AiTM position, the Russian spies can use DNS manipulation to redirect communications to a Secret Blizzard-controlled command-and-control server, and then send the second-stage payload to the victim's device.
This one displays to the victim as a user account control (UAC) pop-up window asking permission to bypass UAC safety mechanisms. If the user clicks "yes," the malware now has the highest-available privileges, which ApolloShadow initially abuses by setting all networks to "private," allowing the host device to become discoverable, and changing firewall rules to enable file sharing.
"While we did not see any direct attempts for lateral movement, the main reason for these modifications is likely to reduce the difficulty of lateral movement on the network," Microsoft wrote.
Finally, ApolloShadow creates an administrative user with the username UpdatusUser and a hardcoded password, set to never expire, on the compromised system using the Windows API NetUserAdd. The malware now has persistent access to the infected host via the newly created local admin user.
To protect against Kremlin spies eavesdropping on devices, Microsoft recommends everyone operating in Moscow — especially sensitive organizations such as foreign embassies — to route all traffic through an encrypted tunnel to a trusted network, not a local ISP. Or, use a virtual private network (VPN) service provider like a satellite-based provider, whose infrastructure is not controlled by Russia or other outside entities. ®
Get our [11]Tech Resources
[1] https://attack.mitre.org/techniques/T1557/
[2] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2aIvnejAeBIxAZGLNCQT1swAAAEc&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0
[3] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44aIvnejAeBIxAZGLNCQT1swAAAEc&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[4] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33aIvnejAeBIxAZGLNCQT1swAAAEc&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[5] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44aIvnejAeBIxAZGLNCQT1swAAAEc&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[6] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33aIvnejAeBIxAZGLNCQT1swAAAEc&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[7] https://www.theregister.com/2025/07/20/uk_microsoft_snooping_russia/
[8] https://www.theregister.com/2025/07/10/russia_ethical_hacking_bill/
[9] https://www.theregister.com/2025/05/21/russias_fancy_bear_alert/
[10] https://www.theregister.com/2025/07/21/massive_security_snafu_microsoft/
[11] https://whitepapers.theregister.com/
Last sentence: Or, use a VPN service provider like a satellite-based provider..."
elDog
"Or, use a virtual private network (VPN) service provider like a satellite-based provider, whose infrastructure is not controlled by Russia or other outside entities."
And who wouldn't trust Musk's StarLink to provide great service.... to Russia.
Re: Last sentence: Or, use a VPN service provider like a satellite-based provider..."
Gene Cash
> use a virtual private network
You mean like the ones Britain is thinking of outlawing?
Tubz
and you don't think western intelligence agencies have permanent tapped ISP lines in secret buildings without lawful orders, the ISPs can see anomalies in the networks and trace them but turn a blind eye too when they get a call from a faceless agency.
veti
They might, or they might not. Either way I don't see any reports on the subject from leading Russian IT companies, or Chinese ones either.
Moscow using everything to catch foreign embassy comms, that's news ?
Pascal Monett
Sorry, but Tom Clancy already wrote about that [1]ages ago .
Say what you want about Clancy, but I'm pretty sure that no US embassy in Moscow would ever consider using Internet - going through a Russia-controlled provider - for anything like secure communication.
They'd use a US-controlled satellite if they wanted anything near confidentiality.
[1] https://en.wikipedia.org/wiki/Red_Rabbit
How is an embassy not using a VPN?
DS999
It doesn't matter who the ISP is if you're using a VPN. Don't need to go so far as to use satellite, just a VPN that will authenticate the remote side using PKE so there's no "middle" attack possible.
I suspect this attack is only being mounted against less capable countries' embassies. No way it will work on the US or any of the larger EU members unless they have criminally incompetent IT staff.
Re: How is an embassy not using a VPN?
veti
How do you connect to the VPN?
Unless you have your own dedicated wires, taking the signal all the way outside the Russian data network and never once using a Russian wire, switch or router, the VPN is just security theatre. You'd need your own trusted satellites to do it, which might be feasible for the Americans but not many others.
Re: How is an embassy not using a VPN?
Anonymous Coward
... and/or the current [1]White House ...
[1] https://www.theregister.com/2025/04/25/signalgate_lessons_learned_if_creating/
Microsoft Threat Intelligence
I'd guess the Russian Threat has a longer history than the Microsoft Threat but that neither should be a surprise to anyone.