Russia-linked APT Secret Blizzard targets foreign embassies in Moscow with ApolloShadow malware

Microsoft uncovered a Russia-linked APT campaign (Secret Blizzard/Turla) using ISP-level adversary-in-the-middle techniques in Moscow to serve a fake captive portal that installs ApolloShadow malware; the malware prompts elevated privileges to install rogue Kaspersky-like root certificates, weaken host defenses, create hidden admin accounts, intercept traffic, and harvest credentials from diplomatic targets, and Microsoft published related IoCs and TTP details.