Russian state hackers hijacked rival servers to spy on targets in India, Afghanistan

Russian state-sponsored APT group Secret Blizzard (Turla) compromised infrastructure owned or used by Pakistan-based Storm-0156 beginning in 2022 to conduct long-running espionage across South Asia; the attackers leveraged existing access to deploy or appropriate malware (TwoDash, Statuezy, Waiscot, CrimsonRAT) against Afghan government and Indian military/defense targets and favored operating through another threat actor’s infrastructure to evade attribution and expand access.