Cybersecurity incident — 2022-03-08 00:00:00
Affected organization: European diplomatic entity
Affected country: Undetermined
Industry: Public Administration
Event type: Exploitive
Event subtype: Exploitation of End Host
Motive: Political-Espionage
Actor: SVR (COZYBEAR)
Actor type: Nation-State
Actor country: Russian Federation

Researchers from Mandiant detect an incident where APT29 successfully phished a European diplomatic entity and ultimately abused the Windows Credential Roaming feature.