Overview

• Microsoft confirms for the first time that the FSB-affiliated group Secret Blizzard holds adversary-in-the-middle positions at the ISP level to intercept embassy communications.
• The campaign exploits Russia’s lawful‐intercept SORM system to redirect diplomats through captive portals that install ApolloShadow malware disguised as a Kaspersky update.
• Once deployed, ApolloShadow installs rogue root certificates to strip TLS/SSL encryption and expose browsing data and credentials in plaintext.
• Active since at least 2024 and first detected by Microsoft in February 2025, the ongoing operation continues to threaten foreign missions and sensitive organizations in Moscow.
• To mitigate the risk, Microsoft advises routing embassy traffic through encrypted tunnels or VPNs and enforcing multifactor authentication.