Frequent freeloader part I: Secret Blizzard compromising Storm-0156 infrastructure for espionage

Microsoft Threat Intelligence details how the Russian nation-state actor “Secret Blizzard” (linked to FSB/ Turla) has, since 2022, been compromising and reusing the C2 infrastructure of the Pakistan-aligned cluster Storm-0156 to deploy backdoors (TinyTurla variant, TwoDash, MiniPocket, Statuezy) and exfiltrate intelligence from targets in Afghanistan and India; the report includes technical analysis of malware and persistence (DLL sideloading, credential backup abuse), actionable IOCs (hashes, domains, IPs), observed victimology, and recommended mitigations for Microsoft Defender and hunting queries.