Leaked internal documents have exposed the activities of a Russian state-backed legal defence foundation that European intelligence agencies and analysts say is in fact a Kremlin influence operation active in 48 countries across Europe and around the world.

Internal documents from the Fund for Support and Protection of the Rights of Compatriots Living Abroad (Pravfond) indicate that the foundation finances propaganda websites targeted at Europeans, helped pay for the legal defence of the convicted arms trafficker Viktor Bout and the assassin Vadim Krasikov, and has employed a number of former intelligence officers as the directors of its operations in European countries.

Key Findings:

• The use of Microsoft OneNote documents to deliver malware via email is increasing.
• Multiple cybercriminal threat actors are using OneNote documents to deliver malware.
• While some campaigns are targeted at specific industries, most are broadly targeted and include thousands of messages.
• In order to detonate the payload, an end-user must interact with the OneNote document.
• Campaigns have impacted organizations globally, including North America and Europe.
• TA577 returned from a month-long hiatus in activity and began using OneNote to deliver Qbot at the end of January 2023.

Google Translate
Portuguese NATO documents caught for sale on the darkweb
The extent of the damage is still being investigated by the National Security Office, but suspicions of the breach of security that facilitated the exfiltration of secret NATO documents fall on EMGFA, secret military and MDN computers.