u/Specialist_Mix_22

GRU tradecraft has changed, but the aim has not. The old operations broke in, stole, leaked, and sometimes destroyed. The new operation is quieter. It compromises routers, bends DNS, abuses QR codes, linked devices, cloud logins, and OAuth prompts.

Investigating Gamaredon’s abuse of CVE-2025-8088, we identified a dozen waves of spearphishing emails against Ukrainian state institutions in a campaign that is still active, dating back to September 2025. These emails – spoofed or sent from compromised government accounts – deliver persistent, multi-stage VBScript downloaders that profile the infected system.

EasterBunny: APT29 Espionage Campaign Uncovered

LAB52, leveraging artifacts and evidence from an incident in 2019, has attributed a sophisticated espionage campaign, dubbed "EasterBunny," to the highly active nation-state threat actor, APT29 (also known as Nobelium or Cozy Bear). This campaign involved advanced artifacts pointing to long-term espionage objectives.

Technical Breakdown:

• Threat Actor: APT29 (Nobelium, Cozy Bear)
• Campaign: EasterBunny, identified in 2019.
• Nature: Highly sophisticated espionage.
• Artifacts: The investigation was based on a set of advanced artifacts and extensive evidence collected during incident response. Specific TTPs, IOCs (IPs, hashes), or affected software versions are not detailed in this initial summary.

Defense: Organisations should bolster incident response capabilities and leverage threat intelligence on APT29 to detect and mitigate their known TTPs, focusing on early detection of advanced persistent threats.

Source: https://lab52.io/blog/easterbunny/