Russian Hackers Use 'WINELOADER' Malware to Target German Political Parties

Mandiant and Zscaler attribute a multi-stage espionage campaign, ongoing since at least July 2023, to APT29 (SVR-linked). Attackers used German-language wine-tasting phishing lures that deliver an HTA ROOTSAW dropper and deploy the WINELOADER backdoor via DLL side-loading (sqldumper.exe) to target diplomatic entities and German political parties across multiple countries.