APT29, a Russian state-sponsored hacking group, has launched an advanced phishing campaign targeting European diplomats through elaborate wine-tasting event invitations. This campaign features a new malware loader called GRAPELOADER, which is designed for enhanced stealth and persistence.
The attackers send cleverly crafted emails that masquerade as invitations from European Ministries for wine-tasting events. These emails contain links that lead to a ZIP archive, which upon execution, deploys the GRAPELOADER malware. This tool stealthily collects host information and modifies the Windows Registry to ensure the malware’s persistent presence on the infected machine.
APT29’s sophisticated method involves using legitimate binaries and DLL hollowing to evade detection. In particular, the malware communicates with command-and-control (C2) servers, often hosted on compromised websites, to fetch additional malicious payloads and send back information about the compromised systems. This campaign also includes an updated variant of WINELOADER.
The deployment techniques, including manipulated PowerPoint files containing the GRAPELOADER via DLL-Side-Loading, show APT29’s sophisticated methodologies. Security teams should look out for specific indicators of compromise, such as filenames, file hashes, and C2 URLs, to detect and mitigate these threats effectively. This incident underscores the importance of keeping systems and web servers secure and up to date to prevent such sophisticated cyber-attacks.

Collections

APT29, a Russian state-sponsored hacking group, has launched a phishing campaign targeting European diplomats with invitations to wine-tasting events. The campaign features advanced malware called GRAPELOADER, which collects host information and modifies the Windows Registry for persistence. The malware uses sophisticated techniques, including DLL hollowing and legitimate binaries, to evade detection. Security teams are advised to monitor specific indicators of compromise to detect and mitigate these threats.

APT29’s Phishing Campaign Targets European Diplomats with GRAPELOADER Malware