Russian-state hackers are targeting foreign embassies in Moscow with custom malware that gets installed using adversary-in-the-middle attacks that operate at the ISP level, Microsoft warned Thursday.

A notorious Russian hacking group is impersonating a prominent cybersecurity firm and using the country’s internet providers to spy on foreign embassies, according to a report published Thursday by Microsoft Corp.

The analysis confirms for the first time that Russia’s Federal Security Service, also known as the FSB, is conducting cyber espionage at the ISP level, according to findings from Microsoft Threat Intelligence.

Russian internet service providers are obliged to work with the government, and attackers use them to plant malware on diplomats’ computers.