Russia's Turla Group Uses ISPs for Spyware Attacks | JQJO

Microsoft researchers revealed a sophisticated hacking technique employed by the Russian state-sponsored group Turla (also known as Snake or Venomous Bear). Turla leveraged its access to Russian ISPs to manipulate internet traffic, tricking embassy staff in Moscow into installing malware disguised as a Kaspersky update. This malware disabled encryption, exposing their communications and credentials to surveillance. The technique combines targeted hacking with mass surveillance, highlighting the group's use of Russia's internet infrastructure as a weapon.