Microsoft Security Blog: Frozen in transit: Secret Blizzard’s AiTM campaign against diplomats

Jul 31, 2025

—

Source URL: https://www.microsoft.com/en-us/security/blog/2025/07/31/frozen-in-transit-secret-blizzards-aitm-campaign-against-diplomats/
Source: Microsoft Security Blog
Title: Frozen in transit: Secret Blizzard’s AiTM campaign against diplomats

Feedly Summary: Microsoft Threat Intelligence has uncovered a cyberespionage campaign by the Russian state actor we track as Secret Blizzard that has been ongoing since at least 2024, targeting embassies in Moscow using an adversary-in-the-middle (AiTM) position to deploy their custom ApolloShadow malware.
The post Frozen in transit: Secret Blizzard’s AiTM campaign against diplomats appeared first on Microsoft Security Blog.

AI Summary and Description: Yes

**Summary:** Microsoft Threat Intelligence has disclosed a cyberespionage campaign orchestrated by the Russian state actor known as Secret Blizzard, targeting embassies in Moscow with a sophisticated adversary-in-the-middle (AiTM) technique. This campaign utilizes a malware called ApolloShadow to install malicious root certificates and collect intelligence from diplomatic devices. The report serves as a significant alert for security professionals, emphasizing the need for enhanced protective measures against advanced persistent threats, particularly for organizations operating in high-risk geopolitical environments.

**Detailed Description:**
The text provides an in-depth analysis of Secret Blizzard’s cyberespionage activities, specifically targeting diplomatic entities in Moscow. The campaign leverages advanced malware and tactics to compromise systems, highlighting critical vulnerabilities in network infrastructure and the necessity for robust security protocols. Major points include:

– **Adversary Description:**
– Secret Blizzard is attributed to the Russian Federal Security Service (Center 16), known for their covert cyber operations against both foreign and domestic entities.
– The use of AiTM techniques suggests a high level of sophistication, enabling persistent access to sensitive communications.

– **Malware Insights:**
– **ApolloShadow**: This malware can install trusted root certificates, allowing for interception and manipulation of secure communications, effectively stripping away TLS/SSL protections.
– The campaign exploits captive portals commonly used in ISPs and telecommunications services to redirect users into downloading compromised software.

– **Initial Access and Delivery:**
– Successful infiltration begins with redirecting users through a captive portal, tricking them into executing ApolloShadow.
– The malware’s landing page appears legitimate, often masquerading as a Kaspersky installer, leading to significant trust exploitation.

– **Defensive Recommendations:**
– Organizations are advised to enhance their network security by:
– Routing all traffic through encrypting tunnels or using trusted VPN services.
– Implementing least privilege access models and multi-factor authentication (MFA) for critical accounts.
– Regularly reviewing admin-level accounts to ensure no unauthorized access has been granted.

– **Detection and Mitigation:**
– Suggestions include enabling cloud-delivered security features for rapid response and using endpoint detection and response (EDR) solutions in block mode to curb potential threats.
– The importance of threat intelligence and proactive monitoring is emphasized, urging organizations to adopt tools like Microsoft Security Copilot for incident response and investigations.

– **Indicators of Compromise (IOCs):**
– The document includes IOCs relevant to the threat actor, facilitating detection and response measures by IT security teams.

This detailed exploration into the tactics, techniques, and procedures (TTPs) of Secret Blizzard emphasizes the complexity of modern cyber threats and the critical need for comprehensive security strategies to safeguard sensitive diplomatic and government infrastructures. Security professionals must stay vigilant and continuously adapt to evolving threat landscapes, particularly in relation to state-sponsored cyber activities.

1 2 2024 2025 24 3 4 5 7 a access account Act advanced advanced malware advanced persistent threat advanced persistent threats adversary age AI analysis and API ApolloShadow app art as at ated attribute authentication Bi by C certificate certificates CI closed Cloud co Col communication Communications. complexity compromised continuous Copilot critical cyber cyber activities Cyber Operations cyber threat cyber threats cyberespionage D de depth detection device document e EDR effective end endpoint endpoint detection endpoint detection and Endpoint Detection and Response environment espionage exp exploit Exploitation exploits exploration fact factor authentication factor authentication (MFA) feature features first for g Gen geo geopolitical git Go government government infrastructure H high Highlight HR http HTTPS in incident incident response indicators indicators of compromise infrastructure infrastructures initial access insights installer Intel intelligence inter investigation investigations io IoC IoCs Iron IRS J k Kaspersky l land leading least Least Priv least privilege least privilege access led level Li load low M malware man manipulation measures MFA Micro Microsoft Microsoft Security Microsoft Security Blog Microsoft Security Copilot Microsoft Threat Intelligence mid middle mitigation Mode model models Modern Monitor monitoring multi multi-factor authentication Multi-Factor Authentication (MFA) N network network infrastructure network security NGO no o of on only operation operations opilot opt organization organizations oS out over per phi pilot point post potential pre privilege access pro proactive proactive monitoring procedures professionals protection protective measures protocol protocols ps Q R rack rag rapid response rate RCE re recommendations red report response review Risk Ro robust security Root Root certificate RoT routing RSA Russia Russian Russian Federal Security Service Russian state actor Rust s safe sec Secret Blizzard secure secure communication secure communications security Security Copilot security features security professionals security protocols security strategies security team security teams sensitive communications service services SHA Sig size sizes software solutions sophistication source specific sponsored sponsored cyber activities SSL state state-sponsored state-sponsored cyber activities STIG strategies structures system systems T tactics team Teams tech techniques ted telecom telecommunications text the threat threat actor threat intel threat intelligence threat landscape threat landscapes threats TLS to tool tools Tor TP traffic trust two unauthorized access US use user Users uth V VPN vulnerabilities Ware Wi x z Zen