APT29, also known as Cozy Bear or Midnight Blizzard, is a Russian espionage hacking group linked to Russia’s Foreign Intelligence Service (SVR) most notably connected to the SolarWinds supply chain attack in 2020, has recently been observed targeting German political parties. This is the first time that researchers have observed APT29 espionage attacks focused on political parties, indicating the group may be shifting their campaign away from typical operations that have previously focused on targeting diplomatic figures. The hacking group’s strategic shift comes amidst Germany’s increased military support for Ukraine, which has resulted in heightened espionage activities against the country, particularly from Russia. The recent campaign involves phishing attacks in the form of emails disguised as dinner invitations hosted by the Christian Democratic Union (CDU), one of Germany’s major political parties, that deploy the WineLoader malware, a backdoor malware that offers remote access to compromised devices and networks which is well suited for remote espionage activities like assisting a threat actor seeking to influence or monitor political processes in Germany. These efforts align with Russia’s broader objectives to understand and predict Western political dynamics, and possibly undermine European support for Ukraine. Experts warn that this targeting campaign is not confined to Germany alone, and could extend to groups across Europe and the U.S. The SVR’s comprehensive approach indicates a systematic attempt to gather intelligence from a variety of organizations and gain insight that would better position Russia’s geopolitical strategies. The Western political entities are advised to remain vigilant and strengthen their cybersecurity defenses to protect against such sophisticated and potentially widespread cyber threats. CTIX analysts will continue monitoring ongoing changes to the cyber threat landscape and the evolving tactics of Russian intelligence services in the context of current geopolitical tensions.