Microsoft Threat Intelligence published a report on Microsoft Security Blog documenting a Secret Blizzard (Turla, VENOMOUS BEAR, Uroburos, Snake, Waterbug) cyberespionage campaign against foreign embassies in Moscow, ongoing since at least 2024. Secret Blizzard — attributed by CISA to Russian FSB Center 16 — exploits an ISP/Telco-level adversary-in-the-middle (AiTM) position, likely facilitated by Russia's SORM (System for Operative Investigative Activities) lawful intercept infrastructure, to deploy the custom ApolloShadow malware against diplomatic targets relying on local Russian internet providers.
ISP-Level AiTM via SORM: Captive Portal Redirect, TLS Stripping, and CertificateDB.exe Masquerading as Kaspersky
The infection chain begins at the network level: Secret Blizzard's AiTM position redirects target devices behind a captive portal, triggering Windows' Test Connectivity Status Indicator (HTTP GET to hxxp://www.msftconnecttest[.]com/redirect). The browser is redirected to an actor-controlled domain presenting a certificate validation error, prompting the user to download and execute ApolloShadow. The initial payload (CertificateDB.exe) masquerades as a Kaspersky installer and presents a UAC prompt requesting elevated privileges. AiTM-enabled TLS/SSL stripping renders most of the target's browsing traffic in cleartext, exposing tokens and credentials to the actor at the ISP layer.
ApolloShadow: Dual-Path Execution, XOR String Obfuscation, Digicert Domain Masquerade C2
ApolloShadow uses GetTokenInformationType to check for TokenElevationTypeFull. In the low-privilege path, it collects network interface information via GetIpAddrTable, double-encodes each IP/MAC entry in Base64 separated by pipe characters and \r\n, then exfiltrates via GET to hxxp://timestamp.digicert[.]com/registered with parameters code (hardcoded) and t (encoded IP data). The /registered resource does not exist on Digicert — Secret Blizzard's DNS manipulation via the AiTM position redirects this request to the actor-controlled C2, which responds with an encoded VBScript second-stage payload. The response header is validated for a 12-character magic string MDERPWSAB64B; the decoded script is written to %TEMP%\edgB4ACD.vbs and executed via CreateProcessW with wscript.exe. Critical strings throughout the binary are XOR-encoded with hardcoded constants, decoded in memory only at point of use, and immediately re-encoded after use to minimize memory forensic exposure.
Elevated Path: Root Certificate Installation, Firefox Trust Bypass, Network Set to Private, and UpdatusUser Admin Account
With elevated privileges, ApolloShadow installs two root certificates from temp files via certutil.exe -f -Enterprise -addstore root and -addstore ca, then deletes the temp files. Firefox's separate certificate store is targeted by writing wincert.js to Firefox's preference directory containing pref("security.enterprise_roots.enabled", true), enabling Firefox to trust the operator-installed root certificates. All connected networks are set to Private via two complementary methods: registry modification at SOFTWARE\Microsoft\Windows NT\CurrentVersion\NetworkList\Profiles (setting Category=0, effective after reboot) and immediate COM-based firewall rule enablement for Network Discovery (FirewallAPI.dll,-32752) and File and Printer Sharing (FirewallAPI.dll,-28502). Finally, a hidden local administrator account UpdatusUser with a hardcoded, non-expiring password is created via NetUserAdd, providing persistent credential-based access independent of any other compromise path.