Security firm RiskIQ finds 35 active command-and-control servers tied to ongoing malware campaign. The servers are located in the U.S., Austria, Bulgaria, Switzerland, Germany, Denmark, France, Hong Kong, Japan and nearly a dozen other countries. These servers are used to deliver custom malware called WellMess and WellMail, RiskIQ says. These malware strains have previously been deployed to target research organizations developing vaccines, the researchers say. The National Security Agency has reported APT29 is an attack group that works within Russia’s Foreign Intelligence Service.”]