Microsoft and Amazon Web Services (AWS) have warned of targeted attacks by a Russian-backed group impersonating staff of the two companies.
The group, tracked by Microsoft as Midnight Blizzard and by AWS as APT29, is known for carrying out hacks on organisations and individuals to gather intelligence on behalf of Russia’s Foreign Intelligence Service (SVR).
The group has been sending out “highly targeted spear-phishing emails” to individuals in government, academia, defence, non-governmental organisations, and other sectors since 22 October, Microsoft said in an advisory.
The emails appear to be sent from addresses gathered during previous compromises in order to appear more authentic, Microsoft said.