Amazon Takes Down Russian APT29 Infrastructure Targeting Users

Amazon’s cybersecurity team has disrupted a sophisticated watering hole campaign orchestrated by APT29, a Russian-linked group, during August 2025. The operation shifted from AWS domain impersonation to compromising legitimate websites and injecting obfuscated JavaScript to redirect visitors, with only 10% of site visitors targeted to avoid detection.

The campaign’s tools included randomisation to redirect small visitor shares, base64 encoding to hide malicious code, and cookies set to prevent repeated redirects, with rapid pivots to new infrastructure when blocks were imposed. The attackers even created convincing fake Cloudflare verification pages on domains such as findcloudflare[ . ]com to exploit Microsoft’s device code authentication workflow.

According to Amazon’s cybersecurity team, no AWS systems were compromised and there was no direct impact on AWS services or infrastructure; after disruption, APT29 migrated operations to alternative cloud providers and registered new domains like cloudflare[ . ]redirectpartners[ . ]com. The effort underscores the value of public–private collaboration, with Amazon coordinating with Cloudflare and Microsoft to isolate affected systems and share threat intelligence.