Operation MacroMaze: new APT28 campaign using basic tooling and legit infrastructure (opens in new tab)

LAB52 has been monitoring a campaign dubbed “Operation MacroMaze”, which, based on its characteristics, can be attributed to APT28, also known as Fancy Bear, Forest Blizzard or FROZENLAKE. The campaign has been active at least since late September 2025 through January 2026, targeting specific entities in Western and Central Europe. The campaign relies on basic tooling and in the exploitation of legitimate services for infrastructure and data exfiltration.