Russia Uses ISPs to Spy on Diplomats, Warns Microsoft

Russian spies are surveilling foreign diplomats by installing malware at Moscow internet service providers, Microsoft warns.

See Also: OnDemand | North Korea’s Secret IT Army and How to Combat It

The computing giant said Friday it has evidence that a Russian state actor it tracks as Secret Blizzard is using an adversary-in-the-middle technique to deploy a custom application known as ApolloShadow. The malware tricks devices into installing root web browser certificates by masquerading as software from Russian cybersecurity firm Kaspersky. That allows cyberspies to strip off web TLS encryption protections and capture web browsing activity, including certain identity tokens and credentials.

“This campaign, which has been ongoing since at least 2024, poses a high risk to foreign embassies, diplomatic entities and other sensitive organizations operating in Moscow, particularly to those entities who rely on local internet providers,” report researchers at Microsoft’s threat intelligence group.

The campaign is the first public confirmation of Russia’s widely suspected use of ISPs to conduct cyberespionage activities against foreign and domestic targets alike. Microsoft said the ISPs involved were likley subject to lawful intercept orders from the Kremlin.

Western intelligence agencies attribute Secret Blizzard to Center 16 of Russia’s Federal Security Service, known as the FSB. The threat actor overlaps with clusters of threat activity also tracked as ATG26, Blue Python, Krypton, Snake, Turla, Uroburos, Venomous Bear, Waterbug and Wraith.

A weakness of the public certificate system is that it depends on a chain of trust culminating in a root certificate provider. Anyone with access to the root encryption keys could intercept network traffic, although end-to-end encryption stops malicious third parties from obtaining anything legible. That still makes hacker attempts to infiltrate the chain of trust a perennial hazard of network security.

Microsoft advises avoiding unprotected use of Russian networks. “Route all traffic through an encrypted tunnel to a trusted network or use a virtual private network – VPN – service provider, such as a satellite-based provider, whose infrastructure is not controlled or influenced by outside parties,” Microsoft said.

The attack is designed to trick a victim into running an installer masquerading software from Moscow-based Kaspersky, which is designed to give attackers elevated privileges on a system and install a fake “Kaspersky Anti-Virus (AV)” root certificate.

A Kaspersky spokesperson distanced the company from the campaign, stating that “trusted brands are often exploited as lures without their knowledge or consent.” The firm – blacklisted in the United States – said it “appreciates Microsoft’s acknowledgment of Kaspersky’s earlier research on targeted attacks through ISPs.”

The certificate appears to be designed to perform SSL stripping attacks – aka SSL downgrade or HTTP downgrade attacks. Such attacks downgrade an HTTPS connection to an insecure HTTP connection, facilitating easy interception.

Russian hackers coerced victims into installing their root certificate by redirecting targeted devices to a captive portal – webpages that manage network access commonly encountered by travelers connecting to a Wi-Fi signal at a hotel or airport. Attackers triggered a legitimate operating system tool – the Windows Network Connectivity Status Indicator, which determines if a device has internet access or not, to direct users to a webpage that likely displays a certificate validation error.

The fake page with a fake certificate validation error prompts users to download the putative Kaspersky application and install a certificate with the file name CertificateDB.exe.

Disguising malware and domains as legitimate software and sites is a repeat Secret Blizzard tactic. Cybersecurity firm Eset reported discovering in 2018 a campaign that since at least two years earlier wielded a fake Adobe Flash installer that appeared to come from a legitimate Adobe domain, which in reality was being spoofed. Eset said the victims of that campaign appeared to be “mainly consulates and embassies from different countries in Eastern Europe or the vicinity,” largely comprised of countries formerly subjugated by the Soviet Union.

Center 16 has been tied to malware attacks from the 1990s, including one of the first known episodes of cyberespionage, dubbed Moonlit Maze by the FBI. Researchers later attributed to the FSB the Agent.btz worm discovered in 2008, which stole military secrets from the Pentagon and helped birth U.S. Cyber Command.