“The Russian Hacker Group of Secret Blizzard, which is directly related to the Federal Security Service of Russia, has used the state communication system (SCR) for cyberbership against foreign embassies in Moscow.”, – WRITE: www.pravda.com.ua
Source: Microsoft Threat Intelligence Report dated July 31, 2025
Details: According to Microsoft, the Secret Blizzard group (also known as Turla) organized a large -scale campaign of cyberbership under foreign embassies operating in Moscow. The hackers were accessed to Russian Internet providers and used their infrastructure to intercept the Internet traffic of diplomatic institutions.
Advertising:
Experts have found that the attack was carried out using the “offender-in-in-the-midle (AITM) technique, which allows you to interfere with the victim and the server to intercept the data.
During attacks, hackers were set on diplomatic devices for Apollloshadow software that allowed the so -called “HTTPS reduction” (TLS/SSL Stripping), that is, to do encrypted victims, including logins, passwords, passwords, authentication tokens.
In addition, Apolloshadow has installed on the device a trusted root certificate “Casper” laboratory, which the victims recognized as safe and allowed hackers to create the visibility of a safe connection even with fake or infected sites. In this way, the group received long -term control over devices of foreign diplomats.
Experts believe that a key role in such a large-scale cyberatta was played by a system of operational search and search measures (variety)-a Russian state system that allows force structures to intercept Internet-traffic in real time.
Reference: Secret Blizzard was identified by the US Cybersecurity and Infrastructure (CISA) as Center 16 FSB. This structure occupies one of the leading places among state hacker groups of the world and is systematically used by Russia in cyberwarrows and campaigns of influence.
Prehistory:
- Secret Blizzard has previously attacked foreign ministries, including Eastern European countries, forcing users to download infected software from controlled servers.
- In 2023, the US Department of Justice reported the neutralization of a large -scale Turla bottlerza used for global espionage in favor of the Kremlin.
- In December 2017, US President Donald Trump signed a law that prohibits the use of Kaspersky Lab software in US government agencies due to fears that it was used by Russia for espionage.
- In March 2022, the US Federal Commission (FCC) included Kaspersky Lab Laboratory (Kaspersky Lab) in the US National Security List.