msftconnecttest[.]com

Microsoft has uncovered a new cyber espionage campaign by the Russian state actor Secret Blizzard, which is targeting embassies located in Moscow. The attacks are assisted by official Russian domestic intercept systems and involve the use of malicious files masquerading as Kaspersky anti-virus software. “This campaign, which has been ongoing since at least 2024, poses a high risk to foreign embassies, diplomatic entities, and other sensitive organizations operating in Moscow, particularly to those entities who rely on local internet providers,” the researchers wrote in a blog dated July 31. Secret Blizzard is an advanced persistent threat (APT) group that US authorities have attributed to Russia’s Federal Security Service (FSB). It targets ministries of foreign affairs, embassies, government offices and defense-related companies, using tactics such as AiTM and spear-phishing, leveraging in-house tools and malware. In late 2024, Microsoft published a series of reports on Secret Blizzard, highlighting its use of other threat actors’ infrastructure and tools, including cybercriminals and other cyber espionage groups. AiTM Enabled by Lawful Intercept Microsoft first observed Secret Blizzard conducting the cyber espionage campaign against foreign embassies located in Moscow in February 2025. It is the first time the threat actor has been observed conducting espionage activities against foreign and domestic entities at the Internet Service Provider (ISP) level. The newly discovered campaign uses an adversary-in-the-middle (AiTM) position to deploy Secret Blizzard’s custom ApolloShadow malware, enabling the group to maintain persistence on diplomatic devices. AiTM is when an attacker positions themselves between two or more networks to support follow-on activity. This means that diplomatic personnel using local ISP or telecommunications services in Russia are highly likely targets of Secret Blizzard within those services. The researchers believe that Secret Blizzard’s AiTM position is likely facilitated by lawful intercept, such as Russia’s domestic intercept system the System for Operative Investigative Activities. This enables the attacker to redirect target devices by putting them behind a captive portal. Such systems are likely integral to enabling the group’s large-scale operations. Once behind a captive portal, the Windows Test Connectivity Status Indicator is initiated, a legitimate service that determines whether a device has internet access by sending an HTTP GET request to hxxp://www.msftconnecttest[.]com/redirect which should direct to msn[.]com. When a target system opens the browser window to this address, it is redirected to a separate actor-controlled domain that likely displays a certificate validation error which prompts the target to download and execute ApolloShadow. Following execution, this malware checks for the privilege level of the ProcessToken. If the device is not running on default administrative settings, ApolloShadow prompts the user to install certificates under a file that masquerades as a Kaspersky installer. When launched, this file installs root certificates, enabling the actor to gain elevated privileges in the system. This enables persistent access to the network, likely for intelligence collection. When the process is executed with sufficient elevated privileges, ApolloShadow alters the host by setting all networks to Private. This induces several changes, allowing the host device to become discoverable and relaxing firewall rules to enable file sharing. How Moscow-Based Embassies Can Protect Themselves Microsoft has advised Moscow-based embassies to route all traffic through an encrypted tunnel to a trusted network or use a virtual private network (VPN) service provider, to help protect against Secret Blizzard’s AiTM tactic. Other recommendations include: Practice the principle of least privilege, and regularly audit privileged account activity in your environments Avoid the use of domain-wide, admin-level service accounts and restrict local administrative privileges Block executable files from running unless they meet a prevalence, age or trusted list criterion Block execution of potentially obfuscated scripts Kaspersky Responds to Microsoft's Findings Cybersecurity firm Kaspersky provided the following statement to Infosecurity in response to Microsoft's research into the Secret Blizzard campaign: "Trusted brands are often exploited as lures without their knowledge or consent. We always recommend downloading applications only from official sources and verifying the authenticity of any communication claiming to be from trusted companies. "Kaspersky is dedicated to safeguarding all users from any threat, no matter its source. Our customers are already protected from the threat described in this research. We appreciate Microsoft's acknowledgment of Kaspersky during earlier research on targeted attacks through ISPs and look forward to continued collaboration in the security community," the company wrote. This article was updated at 14.00 BST to include Kaspersky's comment

The Russian nation-state threat actor known as Secret Blizzard has been observed orchestrating a new cyber espionage campaign targeting foreign embassies located in Moscow by means of an adversary-in-the-middle (AitM) attack at the Internet Service Provider (ISP) level and delivering a custom malware dubbed ApolloShadow. "ApolloShadow has the capability to install a trusted root certificate to trick devices into trusting malicious actor-controlled sites, enabling Secret Blizzard to maintain persistence on diplomatic devices, likely for intelligence collection," the Microsoft Threat Intelligence team said in a report shared with The Hacker News. The activity is assessed to be ongoing since at least 2024, with the campaign posing a security risk to diplomatic personnel relying on local ISPs or telecommunications services in Russia. Secret Blizzard (formerly Krypton), affiliated with the Russian Federal Security Service, is also tracked by the broader cybersecurity community under the monikers Blue Python, Iron Hunter, Pensive Ursa, Snake, SUMMIT, Uroburos, Turla, Venomous Bear, and Waterbug. In December 2024, Microsoft and Lumen Technologies Black Lotus Labs disclosed the hacking group's use of a Pakistan-based threat actor's command-and-control (C2) infrastructure to carry out its own attacks as a way to cloud attribution efforts. The adversary has also been observed piggybacking on malware associated with other threat actors to deliver its Kazuar backdoor on target devices located in Ukraine. The Windows maker noted that the AitM position is likely facilitated by lawful intercept and includes the installation of root certificates under the guise of Kaspersky antivirus to obtain elevated access to the system. Initial access is achieved by redirecting target devices to threat actor-controlled infrastructure by putting them behind a captive portal, leading to the download and execution of the ApolloShadow malware. "Once behind a captive portal, the Windows Test Connectivity Status Indicator is initiated—a legitimate service that determines whether a device has internet access by sending an HTTP GET request to hxxp://www.msftconnecttest[.]com/redirect, which should direct to msn[.]com," Microsoft said. "Once the system opens the browser window to this address, the system is redirected to a separate actor-controlled domain that likely displays a certificate validation error, which prompts the target to download and execute ApolloShadow." The malware then beacons host information to the C2 server and runs a binary called CertificateDB.exe should the device not be running on default administrative settings, and retrieves as a second-stage payload an unknown Visual Basic Script. In the last step, the ApolloShadow process launches itself again and presents the user with a user access control (UAC) pop-up window and instructs them to grant it the highest privileges available to the user. ApolloShadow's execution path varies if the running process is already running with sufficient elevated privileges, abusing them to set all networks to Private via registry profile changes and create an administrative user with the username UpdatusUser and a hard-coded password, allowing persistent access to the machine. "This induces several changes, including allowing the host device to become discoverable, and relaxing firewall rules to enable file sharing," the company said. "While we did not see any direct attempts for lateral movement, the main reason for these modifications is likely to reduce the difficulty of lateral movement on the network." Once this step is successfully completed, victims are displayed a window showing that the deployment of the digital certificates is in progress, causing two root certificates to be installed on the machine using the certutil utility. Also dropped is a file called "wincert.js" that allows Mozilla Firefox to trust the root certificates. To defend against Secret Blizzard activity, diplomatic entities operating in Moscow are urged to implement the principle of least privilege (PoLP), periodically review privileged groups, and route all traffic through an encrypted tunnel to a trusted network or use a virtual private network (VPN) service provider.