Diplomats Beware: Cloaked Ursa Phishing With a Twist

Category	Details
Threat Actors	Cloaked Ursa (aka APT29, UAC-0004, Midnight Blizzard/Nobelium, Cozy Bear), linked to Russia’s Foreign Intelligence Service (SVR).
Campaign Overview	Targeting diplomatic missions, particularly in Ukraine, with phishing lures themed around diplomats’ personal needs (e.g., vehicle acquisition).
Target Regions	Primarily Ukraine; 22 of over 80 foreign missions in Kyiv targeted.
Methodology	Phishing lures using personalized themes such as vehicle acquisition and diplomatic correspondence to entice individuals to open malicious attachments.
Product Targeted	Diplomatic missions and associated individuals’ systems (unspecified specific products).
Malware Reference	Not explicitly named in this text but code overlap with known Cloaked Ursa malware was mentioned.
Tools Used	Custom phishing lures; malware with known code overlap to previous campaigns.
Vulnerabilities Exploited	Not specified.
TTPs	Use of diplomatic-themed phishing lures, targeting individuals’ needs, broad dissemination for increased compromise odds, and reliance on social engineering.
Attribution	Russia’s Foreign Intelligence Service (SVR), based on historical tactics, targets, and code overlap.
Recommendations	Use Palo Alto Networks products for protection; adopt anti-phishing training for staff; implement email filtering and advanced detection mechanisms.
Source	Unit 42 by Palo Alto Networks.

Disclaimer: The above summary has been generated by an AI language model

Recent Posts