European diplomats targeted by Russian phishing campaign promising fancy wine tasting

• Security researchers spotted a new phishing campaign targeting diplomats in Europe
• The targets are invited to an upmarket wine tasting event
• However the emails distribute a new loader called GRAPELOADER

Russian scammers are using diplomats’ love for wine to distribute a nasty new backdoor.

A new report from cybersecurity experts Check Point Research (CPR), who have been tracking the campaign since early 2025, noted infamous state-sponsored threat actor APT29 (AKA Cozy Bear, Midnight Blizzard) is impersonating a major European Ministry of Foreign Affairs as it sends out phishing emails to other diplomats across the continent.