Midnight Blizzard deploys new GrapeLoader malware in embassy phishing

Russian state-sponsored espionage group Midnight Blizzard is behind a new spear-phishing campaign targeting diplomatic entities in Europe, including embassies. Midnight Blizzard, aka 'Cozy Bear' or 'APT29,' is a state-sponsored cyberespionage group linked to Russia's Foreign Intelligence Service (SVR). According to Check Point Research, the new campaign introduces a previously unseen malware loader called 'GrapeLoader,' and a new variant of the 'WineLoader' backdoor. The phishing campaign started in January 2025 and begins with an email spoofing a Ministry of Foreign Affairs, sent from 'bakenhof[.]com' or 'silry[.]com,' inviting the recipient to a wine-tasting event. The email contains a malicious link that, if the victim targeting conditions are met, triggers the download of a ZIP archive (wine.zip). If not, it redirects victims to the legitimate Ministry website. The archive contains a legitimate PowerPoint executable (wine.exe), a legitimate DLL file required for the program to run, and the malicious GrapeLoader payload (ppcore.dll). The malware loader is executed via DLL sideloading, which collects host info, establishes persistence via Windows Registry modification, and contacts the command-and-control (C2) to receive the shellcode it loads in memory. GrapeLoader likely replaces the previously used first-stage HTA loader 'RootSaw,' being stealthier and more sophisticated. Check Point highlights its use of 'PAGE_NOACCESS' memory protections and 10-second delay before run...