CampaignPublished 1 Aug 2025

OSINT · Frozen in transit: Secret Blizzard’s AiTM campaign against diplomats

Affects type osintSource CIRCL OSINT Feed

TLP:WHITE, disclosure is not limited

Description

OSINT - Frozen in transit: Secret Blizzard’s AiTM campaign against diplomats

Impact

For European organizations, particularly diplomatic missions and government agencies, this campaign poses a significant risk of espionage, data theft, and operational disruption. Successful AiTM attacks can lead to unauthorized access to confidential communications, manipulation of diplomatic messages, and potential compromise of authentication mechanisms. This undermines trust in communication channels and may result in exposure of sensitive negotiations or strategic information. The campaign's targeting of diplomats means that European countries with active diplomatic engagements and international organizations are at heightened risk. The impact extends beyond confidentiality to include potential integrity violations and availability disruptions if payloads interfere with communication systems. The medium confidence level and lack of known exploits suggest the threat is currently targeted and sophisticated, requiring specialized detection capabilities. The absence of patches means organizations must rely on procedural and network defenses rather than software updates. Overall, the campaign threatens the security posture of European diplomatic entities and could have broader geopolitical consequences if successful.

Defensive guidance

European organizations should implement multi-layered defenses tailored to AiTM attack vectors. This includes deploying advanced network monitoring and anomaly detection to identify unusual interception or redirection of traffic. Strict email and web gateway filtering should be enforced to block phishing and malicious payload delivery. Organizations must enforce strong authentication mechanisms, including hardware-based multi-factor authentication resistant to interception. Regular threat intelligence sharing focused on Turla and AiTM tactics can improve detection and response. Network segmentation and zero-trust principles should be applied to limit lateral movement if compromise occurs. Diplomatic entities should conduct regular security awareness training emphasizing targeted phishing and social engineering risks. Incident response plans must include scenarios for AiTM attacks, ensuring rapid containment and forensic analysis. Since no patches are available, organizations should review and harden operational procedures around communication channels, including the use of encrypted and out-of-band verification methods. Collaboration with national cybersecurity agencies and international partners is critical to stay updated on emerging indicators and tactics.

Indicators of compromise

Domains 1

Actor-controlled domain that downloads the malware

kav-certificates.info

IP addresses 1

kav-certificates.info: Enriched via the dns module

45.61.149.109

Hashes 36

13fafb1ae2d5de024e68f2e2fc820bc79ef0690c40dbfd70246bcc394c52ea20ApolloShadow malware
1bc5621a4818f2124ac085da21f607ca
60f2c0932b114e99eb81e1ace478b5f5d0fa4d27
13fafb1ae2d5de024e68f2e2fc820bc79ef0690c40dbfd70246bcc394c52ea20
9587f236e40b9581bd7084f68c83b14b
3b165b249f0f93aa64de57543adbbe84da190e95
dd72350864b15b6c9f7aba96b684fb64221f739c11315077b30077f3e70066e3
6e1e998d04e6cc4d269778c76212de86bffb96ec5256fc072dc3137d87695767744b6f32f6a88f17a7336996db0db88704ef56c5da9f66751a7fc4eb6088ccc4
b1adac9933b929c845b4471cf7c2ab27
2a117c1346a4e881498670b01a782b172df64d2d

Link 1

https://www.microsoft.com/en-us/security/blog/2025/07/31/frozen-in-transit-secret-blizzards-aitm-campaign-against-diplomats/

Text 27

Microsoft Threat Intelligence has uncovered a cyberespionage campaign by the Russian state actor we track as Secret Blizzard that has been targeting embassies located in Moscow using an adversary-in-the-middle (AiTM) position to deploy their custom ApolloShadow malware. ApolloShadow has the capability to install a trusted root certificate to trick devices into trusting malicious actor-controlled sites, enabling Secret Blizzard to maintain persistence on diplomatic devices, likely for intelligence collection. This campaign, which has been ongoing since at least 2024, poses a high risk to foreign embassies, diplomatic entities, and other sensitive organizations operating in Moscow, particularly to those entities who rely on local internet providers.
Blog
United States
US
db_source: GeoOpen-Country. build_db: 2025-03-12 07:11:56. Latitude and longitude are country average.
United States
US
db_source: GeoOpen-Country-ASN. build_db: 2025-03-12 07:19:04. Latitude and longitude are country average.
14956
ASNOrganization: ROUTERHOSTING. db_source: GeoOpen-Country-ASN. build_db: 2025-03-12 07:19:04.

Float 12

38
-97
38
-97
6.4687295604183
4.9337559296997
3.068662876151
5.2142325249842
2.8235356273006
6.591825724894

Tlsh 1

t1d5344a0973d50cf9e837813988525a46ea72b8150771dfaf13a0426adf776e0ed3af21

Vhash 1

025076655d15551565508016z521z7jzc1z5bz

Ssdeep 9

3072:7UAhJPJwCZQw5eA8H/Y+rjTMRGX/C32kjWb/nE3LcgZQz35S0pzoY46CQ1gqLMGx:IA5RRqUjWrnEPQzbohq1LM8
3072:AUAhJPJwCZQw5eA8H/Y+rjTMRGX/C32kjWb/nE3LcgZQzx:jA5RRqUjWrnEPQzx
1536:rFss84dh1qE4oajTdobHoWJ4K9dlUzisWtd1ip1DqL/HstcbM:55S0pzoY46CQ1gqLMGbM
48:z+EEEEEEJLjTkPkBTkQnuDQafFdpcHIG4:z+EEEEEEZaklnulfFdprG4
96:9zLLE98v0oONctjLbw0R/zrUHu1Wnau58EjKcBgDJDsYHQgJIcYOxUVl9IUKp/qR:p3E9iONQhpIHu1Lu/KpdJXYOCl9e4
3:klJVllEflrldyLzObZllJFhr5et2/6lzxbXZh1lPXlPNFPn:kjV/ZGctmOL
24:edOWNRb9SeI1hCc1CE9yr37uVHdt4VBgD4IINfr/biNK+bIgMy5xvW0WiCgu8:edOU9I1NNyO9SngsIE6K+bIgMy/548
96:8TxP8vvElvvNiPEvv2nJOnnsnDPEvvIkvP8vviUPEvv7HcGx:CxsElqEX2JusrEXIssKcEX7HcGx
3072:7UAhJPJwCZQw5eA8H/Y+rjTMRGX/C32kjWb/nE3LcgZQz35S0pzoY46CQ1gqLMGx:IA5RRqUjWrnEPQzbohq1LM8

Size in bytes 8

128000
90624
4608
7168
512
2048
3584
237568

Datetime 1

2024-02-08T06:16:20+00:00

Imphash 1

8b85b6f1045e6f05aad33e1fed74b176

Authentihash 1

37cf8e0d1d57931ec4fcb56e6116ccc225fbd44fc383732e76609554d0ae46b4

Counter 1

File 1

13fafb1ae2d5de024e68f2e2fc820bc79ef0690c40dbfd70246bcc394c52ea20

Malware sample 1

13fafb1ae2d5de024e68f2e2fc820bc79ef0690c40dbfd70246bcc394c52ea20|1bc5621a4818f2124ac085da21f607ca

Mime type 1

application/vnd.microsoft.portable-executable

Community reviews

Loading reviews…