Russian hackers shift to cloud attacks, US and allies warn

APT29 (SVR) is increasingly targeting cloud services across governments and critical organizations, using credential-based attacks (brute force/password spraying), stolen access tokens, dormant accounts, MFA fatigue, device enrollment abuse, and malware like MagicWeb; a Five Eyes advisory details these cloud-focused TTPs, recent compromises (including Exchange Online), and prescribes mitigations such as enforcing MFA, least privilege, canary accounts, reduced session/token lifetimes, and strict device enrollment controls.