The Nearest Neighbor Attack: How A Russian APT Weaponized Nearby Wi-Fi Networks for Covert Access
Summary: Volexity traced a February 2022 breach of a customer's enterprise Wi-Fi network to GruesomeLarch, a Russian APT also known as APT28 and Fancy Bear, which was targeting data on individuals and projects involving Ukraine. The actor validated credentials through password-spray attacks against an internet-facing service, then reached the target's Wi-Fi by compromising nearby organizations and using a dual-homed system's Wi-Fi adapter to connect to the SSID, an approach Volexity calls the Nearest Neighbor Attack.
What you should know: The Wi-Fi network required only a valid domain username and password, with no MFA, so proximity and brute-forced credentials were the only requirements to connect - and the attacker was thousands of miles away, an ocean apart from the victim.
Read the original at Volexity Blog ↗
- Topics
- Threat Actors & Nation-State
- Related
- University of Texas at Arlington warns personal information stolen during cyberattack Cyber Risks · Nov 13, 2026Hackers Exploit PHP2Shell Flaws in Check Point Gateways to Deploy TSGA Backdoor and Wipe ESXi Files Cyber Risks · Nov 13, 2026Hackers compromise 4,800 GitHub accounts to steal cloud credentials Cyber Risks · Nov 12, 2026