Microsoft: Russian hackers use ISP access to hack embassies in AiTM attacks

Microsoft attributes an ongoing (since at least 2024) ISP-level adversary-in-the-middle espionage campaign in Moscow to Secret Blizzard (Turla), reporting that the group redirects diplomatic targets to captive portals and deploys ApolloShadow malware disguised as a Kaspersky update that installs a trusted root certificate, enabling persistent interception and credential/traffic spoofing against foreign embassies and sensitive organizations.