APT29 Deploys GRAPELOADER via Wine-Tasting Phishing Emails

In early 2025, APT29 launched a targeted phishing campaign impersonating a European Ministry of Foreign Affairs, using wine-tasting event invitations to deliver malware. The attackers deployed a new loader called GRAPELOADER via DLL side-loading, establishing persistence and communicating with C2 servers. This loader then delivered the advanced WINELOADER backdoor, which uses strong encryption and anti-analysis techniques for stealthy data exfiltration. The campaign highlights APT29’s evolving tactics targeting diplomatic and government entities with sophisticated malware and social engineering.