The Russian state hacker group known as Turla has carried out some of the most innovative hacking feats in the history of cyberespionage, hiding their malware's communications in satellite connections or hijacking other hackers' operations to cloak their own data extraction. When they're operating on their home turf, however, it turns out they've tried an equally remarkable, if more straightforward, approach: They appear to have used their control of Russia's internet service providers to directly plant spyware on the computers of their targets in Moscow.

Microsoft's security research team focused on hacking threats today published a report detailing an insidious new spy technique used by Turla, which is believed to be part of the Kremlin's FSB intelligence agency. The group, which is also known as Snake, Venomous Bear, or Microsoft's own name, Secret Blizzard, appears to have used its state-sanctioned access to Russian ISPs to meddle with internet traffic and trick victims working in foreign embassies operating in Moscow into installing the group's malicious software on their PCs. That spyware then disabled encryption on those targets' machines so that data they transmitted across the internet remained unencrypted, leaving their communications and credentials like usernames and passwords entirely vulnerable to surveillance by those same ISPs—and any state surveillance agency with which they cooperate.

Sherrod DeGrippo, Microsoft's director of threat intelligence strategy, says the technique represents a rare blend of targeted hacking for espionage and governments' older, more passive approach to mass surveillance, in which spy agencies collect and sift through the data of ISPs and telecoms to surveil targets. “This blurs the boundary between passive surveillance and actual intrusion,” DeGrippo says.

For this particular group of FSB hackers, DeGrippo adds, it also suggests a powerful new weapon in their arsenal for targeting anyone within Russia's borders. “It potentially shows how they think of Russia-based telecom infrastructure as part of their toolkit,” she says.

According to Microsoft's researchers, Turla's technique exploits a certain web request browsers make when they encounter a “captive portal,&rdquo...