The Russian state-sponsored threat actor APT29 is linked to a sophisticated phishing campaign targeting European diplomatic entities, utilizing a new variant of WINELOADER and a previously unreported malware loader called GRAPELOADER. The enhanced WINELOADER remains a modular backdoor used in later stages of the attack, while GRAPELOADER serves as a newly identified initial-stage tool. This development underscores the ongoing threat posed by APT29 to critical diplomatic infrastructure in Europe.