Secret Blizzard Group’s ApolloShadow Malware Install Root Certificates on Devices to Trust Malicious Sites

Microsoft analysts uncovered a sophisticated Secret Blizzard AiTM campaign targeting foreign embassies in Moscow using ApolloShadow malware deployed via ISP-level interception. ApolloShadow installs malicious root and CA certificates (using certutil), modifies Firefox to trust those certificates, creates a persistent administrative account, and alters network profiles to enable interception and potential lateral movement, representing a high-risk nation-state espionage operation.