Overview of Russian GRU and SVR Cyberespionage Campaigns 1H 2022

This report compiles OSINT and vendor findings on Russian APT activity (FancyBear/APT28 and CozyBear/APT29) in the first half of 2022, documenting widespread credential-phishing campaigns, newly observed malware (including a .NET infostealer and CredoMap), exploitation of the MSDT Follina RCE (CVE-2022-30190), abuse of legitimate cloud APIs (Trello, Dropbox) for C2/exfiltration, and links to prior supply-chain intrusions (SolarWinds); it concludes with IOCs and actionable mitigations for detection, patching, and hunting.