APT29 Uses WINELOADER to Target German Political Parties

Executive Summary

• In late February, APT29 used a new backdoor variant publicly tracked as WINELOADER to target German political parties with a CDU-themed lure.  
• This is the first time we have seen this APT29 cluster target political parties, indicating a possible area of emerging operational focus beyond the typical targeting of diplomatic missions.
• Based on the SVR’s responsibility to collect political intelligence and this APT29 cluster’s historical targeting patterns, we judge this activity to present a broad threat to European …

apt29 area backdoor beyond cluster emerging executive february focus german operational political target targeting wineloader