Cloaked Ursa

Cloaked Ursa is a Russia-linked espionage threat actor publicly attributed by the United States and the United Kingdom to Russia’s Foreign Intelligence Service (SVR). It is also tracked as APT29, Midnight Blizzard, Nobelium, Cozy Bear, and UAC-0004. The group is well known for targeting diplomatic missions globally. The provided content describes Cloaked Ursa conducting spear-phishing and social-engineering operations, including use of compromised accounts to send Microsoft Teams messages with malicious links that redirected victims to credential-harvesting pages mimicking Microsoft login portals in late 2024. The actor was also observed using spear phishing prior to internal Microsoft 365 / Entra tenant exploration. The content further links Cloaked Ursa to use of the ROADtools framework in late 2021 after initial access via spear phishing. Reported capabilities associated with this tooling include tenant reconnaissance, enumeration of Entra ID resources, token acquisition and exchange, replay of stolen session assets, rogue device registration, and stealthy use of legitimate Microsoft APIs. Unit 42 also reported Cloaked Ursa phishing campaigns in 2023 against diplomatic targets in Ukraine and Turkey. In Kyiv, the actor repurposed a legitimate BMW-for-sale flyer and sent malicious versions to diplomatic missions, targeting at least 22 of more than 80 foreign missions. The infection chain used URL shorteners, a compromised website, HTA delivery, ISO files, LNK files masquerading as PNG images, and DLL sideloading via APPVISVSUBSYSTEMS64.dll and a legitimate Word binary. The final payload used Microsoft Graph API and Dropbox API for command and control, included anti-analysis checks, and supported shellcode injection, command execution, and file read/write operations. A separate likely campaign targeted the Turkish Ministry of Foreign Affairs with a humanitarian-assistance-themed lure after the February 2023 earthquakes. The reported malware shared code and tradecraft overlap with previously reported Cloaked Ursa tooling, including QUARTERRIG and similarities to SNOWYAMBER string encryption techniques. Based on the provided content, Cloaked Ursa is a state-linked espionage actor focused on diplomatic and cloud identity targets, using phishing, credential theft, collaboration-platform abuse, cloud reconnaissance, token abuse, and stealthy post-compromise activity.