Experts Uncover Several C&C Servers Linked to WellMess Malware. Cybersecurity researchers on Friday unmasked new command-and-control infrastructure belonging to the Russian thre at actor tracked as APT29, aka Cozy Bear, that has been spotted actively serving WellMess malware as part of an ongoing attack campaign.