Russian internet service providers are obliged to work with the government, and attackers use them to plant malware on diplomats’ computers.

A Russian hacking group known as Secret Blizzard, which is directly linked to Russia’s Federal Security Service (FSB), has used a state surveillance system to conduct cyberespionage operations against foreign embassies in Moscow.

The attack works by rerouting targeted diplomatic devices through a hoax captive portal modeled on the kind commonly used to grant internet access in hotels and airports.

The analysis confirms for the first time that Russia’s Federal Security Service, also known as the FSB, is conducting cyber espionage at the ISP level, according to findings from Microsoft Threat Intelligence.