Russia Linked to New Malware Targeting Email Accounts for Espionage – Source: www.infosecurity-magazine.com

Russian military intelligence (GRU)-linked threat actors have been using previously unknown malicious software to enable espionage against victim email accounts, the UK’s National Cyber Security Centre (NCSC) has reported.

The new sophisticated malware has been dubbed “Authentic Antics,” and the NCSC has said threat group APT28, which itself is linked to the GRU, has been responsible for deploying the malicious software.

Authentic Antics has been specifically designed to enable persistent endpoint access to Microsoft cloud accounts by blending in with legitimate activity, NCSC analysis has shown.

“Significant thought” has gone into designing the malware to achieve the appearance of authentic Microsoft Outlook activity.

It periodically displays a login window prompting the user to share their credentials, which are then intercepted by the malware, along with OAuth authentication tokens that allow access to Microsoft services.

The malware also exfiltrates victims’ data by sending emails from the victim’s account to an actor-controlled email address without the emails showing in the “sent” folder.

Analysis of the malware showed that there is no traditional command-and-control implemented that may have increased the likelihood of it being detected.

Russian Cyber-Threat Remains Persistent

Paul Chichester, NCSC Director of Operations commented, “The use of Authentic Antics malware demonstrates the persistence and sophistication of the cyber threat posed by Russia’s GRU.”

“NCSC investigations of GRU activities over many years show that network defenders should not take this threat for granted and that monitoring and protective action is essential for defending systems,” he noted.

The Authentic Antics malware was discovered in the aftermath of a cyber incident which was investigated by Microsoft and the NCSC-assured cyber incident response provider NCC Group in 2023. 

On June 17, National Computer Emergency Response Team of Ukraine (CERT-UA) identified an new malware, dubbed “LameHug,” which it said, with moderate confidence, could be linked to APT28 cyber-attacks targeting the nation’s security and defense sector.

Read more about new LameHug malware: New “LameHug” Malware Deploys AI-Generated Commands 

In May 2025, a joint cybersecurity advisor from the US National Security Agency and allies including the NCSC, highlighted a Russian state-sponsored cyber campaign targeting Western logistics entities and technology companies. This activity was also linked to APT28.

UK Sanctions Russian GRU Officers

The same date the UK Government shared the analysis of the Authentic Antics malware, it also announced the sanctioning of three GRU Units: 26165, 29155 and 74455, and 18 GRU officers and agents for their part in cyber and information interference operations across the globe in support of wider Russian geopolitical and military objectives.

The UK’s Foreign Secretary, David Lammy, said, “The Kremlin should be in no doubt: we see what they are trying to do in the shadows and we won’t tolerate it. That’s why we’re taking decisive action with sanctions against Russian spies. Protecting the UK from harm is fundamental to this government’s Plan for Change.”

APT28 is also tracked as Fancy Bear, Pawn Storm, Sednit, Sofacy and Iron Twilight.