Wave of Wine-Inspired Phishing Attacks Targets EU Diplomats

Check Point Research observed an APT29 phishing campaign impersonating a European Ministry of Foreign Affairs that lures diplomats with wine‑tasting invitations. Clicking malicious links downloads a wine.zip bundle containing a PowerPoint executable used for DLL side‑loading and a heavily obfuscated loader (ppcore.dll) that deploys a new backdoor dubbed GrapeLoader (with a later-stage WineLoader variant); the malware establishes persistence via the Windows Run key, collects basic host information, and waits for C2-delivered shellcode while the attacker employs anti-analysis and geo/time activation controls.