Loading story…
Mandiant reported that APT29 conducted phishing campaigns that leveraged Atlassian Trello and cloud-hosted infrastructure to support credential theft and follow-on intrusion activity. The operation used legitimate online services to blend malicious traffic with normal business activity, a tactic that can complicate detection and attribution while helping the threat actor stage phishing lures and redirect victims through trusted platforms.
The reporting links the activity to the Russia-aligned espionage group commonly tracked as APT29, which is known for stealthy, intelligence-focused operations against government and other high-value targets. The campaign highlights continued abuse of widely used SaaS and cloud services as part of state-backed phishing tradecraft, reinforcing the need for defenders to monitor suspicious authentication flows, investigate links delivered through trusted collaboration platforms, and harden identity protections against credential-harvesting attempts.
TTPs, infrastructure, and targeting history in one profile.
1 event from the most recent confirmed update back to the earliest known activity.
Mandiant reported that APT29 ran phishing operations that leveraged legitimate cloud platforms and services as part of its intrusion activity. The references do not provide a more specific event date in the supplied content, so the publication date is used as the estimate.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Amazon and Microsoft disclosed a large spear-phishing campaign by **APT29**/**Midnight Blizzard**, the Russian state-linked espionage group tied to the **SVR**, that used signed malicious **`.rdp`** files to trick targets into launching outbound Remote Desktop connections to attacker-controlled servers. The operation, tracked by CERT-UA as **`UAC-0215`**, relied on emails sent from previously compromised legitimate accounts and lures themed around **Amazon Web Services**, **Microsoft**, and **Zero Trust** integration issues. Amazon said the attackers used lookalike AWS-related domains, which it moved to seize, but the campaign was aimed at stealing victims' **Windows credentials** and collecting data rather than compromising Amazon or AWS customer accounts directly. Microsoft said the campaign targeted **thousands of recipients across dozens of countries**, including Ukraine, the UK, Europe, Australia, and Japan, with victims spanning government, academia, defense, and NGOs. CERT-UA warned that opening the rogue RDP attachments could expose local disks, network shares, printers, COM ports, audio devices, clipboard contents, and credentials to the attackers, while also enabling unauthorized program or script execution for follow-on activity. Defenders were urged to block **`.rdp`** files at email gateways, monitor and restrict outbound RDP connections from **`mstsc.exe`**, and apply the indicators and mitigations published by Microsoft and CERT-UA.
Jun 29, 2026
Poland’s **CERT.PL** and the **Military Counterintelligence Service** disclosed a phishing-based espionage campaign targeting diplomatic personnel and attributed it to **APT29**, also tracked as **Nobelium** and **Cozy Bear**. The operation used phishing lures to deliver multiple malware families, including **HALFRIG**, **QUARTERRIG**, and **SNOWYAMBER**, with **ENVYSCOUT** commonly serving as the delivery script before follow-on activity involving **Cobalt Strike** or **Brute Ratel**. SecurityScorecard’s STRIKE Team reviewed related indicators and network traffic tied to the campaign but said the infrastructure evidence was not conclusive because the same hosting IPs also supported unrelated domains and much of the observed traffic traversed large hosting providers. Even so, some transfer patterns involving IP space in the **United States, United Kingdom, and Germany** were assessed as potentially consistent with diplomatic targeting aligned with Russian intelligence interests.
Aug 21, 2026
MITRE ATT&CK documents **APT42** as a phishing-focused threat actor that steals credentials and MFA tokens through spearphishing links, impersonation, and cloned login pages, including interception of SMS one-time passwords. The group is also associated with masquerading domains, anonymized VPS infrastructure, and command-and-control over **HTTPS**, including use of **NICECURL** and Base64-encoded traffic. On compromised systems, APT42 has used PowerShell, scripts, and WMI for discovery, deployed malware for keylogging, screenshots, and browser credential and cookie theft, and collected data from **Microsoft 365** environments while using built-in cloud features and public tools to reduce detection. The mapped tradecraft also shows APT42 maintaining access through Registry changes and scheduled tasks, while removing evidence by clearing Chrome history and deleting mailbox artifacts. Separately, Splunk published a detection for suspicious creation or modification of files in Linux `/etc/update-motd.d`, a persistence path where login-triggered Message of the Day scripts can be abused to execute malicious code. The analytic, based on endpoint filesystem telemetry such as **Sysmon for Linux Event ID 11**, is disabled by default and intended to surface intermediate risk events because legitimate administrative changes can also trigger the rule.
Aug 12, 2026