Fancy Bear 'Nearest Neighbor' Attack Uses Nearby Wi-Fi Network

Fancy Bear (APT28) executed a sophisticated "Nearest Neighbor" espionage campaign by compromising nearby organizations' Wi‑Fi networks via credential-stuffing and chaining access through Organizations B and C to reach a US target; the actor used RDP, living‑off‑the‑land utilities like Cipher.exe and netsh to move laterally and collect data, and researchers recommend Wi‑Fi/Ethernet segmentation, MFA/certificate-based Wi‑Fi authentication, and monitoring for anomalous utility usage to detect similar intrusions.