Loading story…
The China-linked advanced persistent threat group APT31 conducted a prolonged cyber espionage campaign against Russian IT companies, particularly those serving government agencies, from at least late 2022 through 2025. The attackers leveraged legitimate Russian cloud services, such as Yandex Cloud, for command-and-control and data exfiltration, blending their malicious traffic with normal network activity to evade detection. They also staged encrypted payloads and commands on social media profiles and timed their operations to coincide with weekends and holidays, when staffing was minimal. In several cases, APT31 maintained undetected access to victim networks for extended periods, with activity surging during the 2023 New Year holidays and continuing into 2024 and 2025. The campaign focused on intelligence gathering to benefit Chinese state interests, targeting contractors and integrators working with Russian government agencies.
Technical analysis by Positive Technologies and corroborated by other security firms revealed that APT31 used a combination of publicly available tools and custom malware, routing commands through popular web platforms to further mask their activity. The group’s operations against Russia are notable given the countries' strategic partnership and the rarity of public reporting on Chinese cyber activity targeting Russian entities. The campaign highlights the increasing sophistication of APT31’s tradecraft, including the use of cloud infrastructure and social media for stealthy command-and-control, as well as the geopolitical implications of Chinese cyber espionage against Russian technology firms involved in sensitive government projects.
TTPs, infrastructure, and targeting history in one profile.
5 events from the most recent confirmed update back to the earliest known activity.
Kaspersky previously reported activity related to the campaign and identified overlaps with a cluster it tracks as EastWind, adding technical context to the intrusions.
Positive Technologies linked a series of cyber-espionage attacks on Russian IT firms to APT31, describing the group’s use of Yandex Cloud, social media, and cloud-based command-and-control to evade detection.
In May 2025, the Czech Republic publicly attributed targeting of its Ministry of Foreign Affairs to APT31, marking a separate official attribution tied to the group.
During 2024–2025, APT31 conducted targeted intrusions against Russian technology organizations, including government contractors and systems integrators. Some compromises reportedly remained undetected for years.
Reporting describes APT31 as an intelligence-focused threat group that has operated since at least 2010 in support of Beijing’s political, economic, and military interests.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Google Threat Intelligence published a report detailing the cyber-espionage operations of **APT28**, the Russia-linked threat group also tracked as **Fancy Bear**. The report describes how the group has conducted long-running intelligence collection campaigns aligned with Russian state interests, targeting governments, military organizations, defense sectors, media, and other high-value entities. The activity is presented as a window into how a mature state-backed actor selects victims, sustains access, and supports broader geopolitical objectives through cyber operations. The report highlights APT28 as a persistent espionage actor known for credential theft, phishing, malware deployment, and post-compromise tradecraft designed to collect sensitive information from targeted networks. By outlining the group’s operational patterns and targeting behavior, Google’s analysis gives defenders updated context on a prominent Russian intrusion set and reinforces the need for stronger monitoring of phishing activity, account compromise, and unauthorized access across organizations exposed to nation-state threats.
Jul 12, 2026
Chinese state-linked hackers, identified as the Jewelbug group, infiltrated a major Russian IT service provider in a sophisticated espionage campaign that spanned from January to May 2025. The breach was uncovered by Symantec researchers, who reported that the attackers gained access to the company’s software build and code repository systems, raising concerns about a potential software supply chain attack targeting the provider’s downstream clients. The targeted company, though unnamed, is described as a significant provider with government-related clients, amplifying the potential impact of the intrusion. Jewelbug, also tracked as Earth Alux, CL-STA-0049, and REF7707 by various security vendors, has a history of targeting government and corporate networks across South America, South and Southeast Asia, and Taiwan, but this marks a rare incursion into Russian infrastructure. The attackers conducted extensive reconnaissance, stole credentials, and maintained persistent access within the network, demonstrating advanced operational capabilities. Notably, the group used Yandex Cloud, a legitimate Russian cloud platform, to exfiltrate data, a tactic likely chosen to evade detection by blending malicious activity with normal network traffic. The use of Yandex Cloud is particularly effective in Russia, as it is a trusted domestic service and unlikely to be blocked or scrutinized by local enterprises. Technical analysis revealed that the attackers leveraged a renamed version of Microsoft Console Debugger (cdb.exe) to run shellcode, bypass application allowlisting, and disable security solutions, further highlighting the sophistication of the operation. The campaign is assessed to be part of a broader espionage effort, with no evidence of financial motivation. Researchers also observed the deployment of advanced malware, including FINALDRAFT (aka Squidoor), capable of infecting both Windows and Linux systems, and noted the possible development of new backdoors during related intrusions. The breach underscores that Russia is not immune to Chinese cyber espionage, despite close diplomatic and economic ties between the two countries. The incident has raised concerns about the security of Russian government and corporate networks, particularly those relying on IT service providers for software distribution and network management. The potential for a supply chain attack means that dozens of Russian companies could have been exposed to further compromise. The Jewelbug group’s operations reflect a growing trend of state-sponsored actors targeting IT service providers to maximize access and impact. The incident also highlights the importance of monitoring legitimate cloud services for signs of abuse in cyber operations. Security experts recommend heightened vigilance and improved monitoring of software build environments and cloud service usage to detect and mitigate similar threats. The breach serves as a reminder that geopolitical alliances do not guarantee immunity from cyber espionage activities. Ongoing analysis is expected to reveal further details about the attackers’ methods and the full scope of the compromise.
Jun 29, 2026
Google-owned Mandiant detailed how **APT41**, a China-linked threat group also known as **Double Dragon**, continues to blend state-aligned espionage with financially motivated intrusions. The reporting describes a long-running operation in which the group targets organizations across multiple sectors and geographies while using a broad toolkit of malware, compromised infrastructure, and hands-on-keyboard tradecraft to steal data, maintain persistence, and support intelligence collection. Mandiant said APT41 stands out because it operates at the intersection of **nation-state espionage** and **cybercrime**, shifting between strategic targeting and profit-driven activity without separating the two missions. The group has been tied to intrusions affecting enterprises worldwide and remains notable for its adaptability, operational scale, and ability to exploit trusted environments to advance both theft and surveillance objectives.
Jul 12, 2026