Russian hackers target German political parties with WineLoader malware

Researchers are warning that a notorious hacking group linked to Russia's Foreign Intelligence Service (SVR) is targeting political parties in Germany for the first time, shifting their focus away from the typical targeting of diplomatic missions. The phishing attacks are designed to deploy a backdoor malware named WineLoader, which allows threat actors to gain remote access to compromised devices and networks. APT29 (also known as Midnight Blizzard, NOBELIUM, Cozy Bear) is a Russian espionage hacking group believed to be part of the Russian Foreign Intelligence Service (SVR) The hacking group has been linked to many cyberattacks, including the infamous SolarWinds supply chain attack in December 2020. The threat actors have remained active throughout these years, typically targeting governments, embassies, senior officials, and various entities using a range of phishing tactics or supply chain compromises. APT29's recent focus has been on cloud services, breaching Microsoft systems and stealing data from Exchange accounts, and compromising the MS Office 365 email environment used by Hewlett Packard Enterprise. Mandiant researchers say that APT29 has been conducting a phishing campaign against German political parties since late February 2024. This marks a significant shift in the hacking group's operational focus, as it's the first time the hacking group has targeted political parties. The hackers now use phishing emails with a lure themed around the Christian Democratic Uni...