Microsoft Threat Intelligence researchers have issued a warning about Russian state-sponsored hackers targeting Windows users with a custom tool to steal credentials and install backdoors. The hackers, known as APT28 or Fancy Bear and tracked by Microsoft as Forest Blizzard, are affiliated with Russia’s GRU military intelligence agency.
Forest Blizzard/APT28 has been using a post-exploitation tool called GooseEgg against government, education, and transport sector organizations in the U.S., Western Europe, and Ukraine. This group primarily focuses on strategic intelligence targets and has been utilizing GooseEgg since at least June 2020.
