Amazon Disrupts Russian APT29 Cyber Espionage with Microsoft, Cloudflare

Russian Spies Turn Everyday Websites Into Watering Holes

Maria thought she was just browsing her favorite tech news site during her lunch break. She clicked on an article, waited for it to load and then suddenly found herself on what looked like a Cloudflare security verification page. It seemed legitimate—the kind of thing she'd seen dozens of times before when websites were checking for suspicious traffic. She was about to enter her credentials when something made her pause. That moment of hesitatio…

Amazon shuts down watering hole attack attributed to Russia’s APT29 hacking group

In October 2024, Amazon disrupted another APT29 operation that attempted to use phishing domains impersonating AWS.

Amazon Disrupts Russian APT29 Cyber Espionage with Microsoft, Cloudflare

In a significant blow to cyber espionage efforts, Amazon.com Inc. has dismantled a sophisticated hacking operation linked to Russia’s APT29 group, also known as Midnight Blizzard or Cozy Bear. The campaign exploited compromised websites to target Microsoft 365 users, aiming to steal credentials through deceptive authentication flows. According to details shared by Amazon’s threat intelligence team, the attackers used “watering hole” tactics, inj…