Russian State Hackers Spy on Moscow Embassies via ISP-Level AiTM Attacks

Microsoft uncovered a sophisticated Russian state-sponsored AiTM operation (Secret Blizzard) targeting diplomatic devices in Moscow using custom malware called ApolloShadow; the malware installs malicious root certificates, intercepts and decrypts traffic, exfiltrates credentials, creates a persistent administrative account (UpdatusUser), and leverages ISP-level redirection and spoofed domains to deliver and control payloads.