Loading story…
Researchers linked multiple highly targeted phishing campaigns to Fighting Ursa / APT28 and related tracking names including ITG05, Fancy Bear, and Forest Blizzard, using tailored geopolitical and diplomatic lures to deliver the HeadLace backdoor. In one operation, attackers sent a fake "Diplomatic Car For Sale" advertisement for an Audi Q7 to likely diplomatic targets, leading victims to a ZIP archive containing a double-extension executable disguised as an image. The malware chain abused legitimate services such as Webhook.site and ImgBB, sideloaded a malicious WindowsCodecs.dll through a legitimate calc.exe, and used a batch script to launch Microsoft Edge with Base64-encoded content to fetch and run a second-stage payload.
A separate campaign used authentic-looking documents themed around the Israel-Hamas conflict to target academic, finance, diplomatic, and policy-linked organizations involved in humanitarian aid and foreign-policy decision-making, primarily in Europe. IBM said the infrastructure applied country-based filtering so only intended victims in specific countries could retrieve the malware, with targets identified across at least 13 countries, including several UN Human Rights Council members. Across the reporting, HeadLace was described as closely associated with this actor set, reinforcing assessments that the activity supported selective intelligence collection against diplomatic and policy-focused entities.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
3 events from the most recent confirmed update back to the earliest known activity.
A Webhook.site URL used in the Fighting Ursa phishing chain was submitted to VirusTotal on March 14, 2024. Unit 42 identified this URL as part of the infrastructure serving the fake diplomatic car sale lure and malware delivery flow.
Beginning as early as March 2024, Fighting Ursa ran a phishing campaign likely targeting diplomats with a fake 'Diplomatic Car For Sale' advertisement for an Audi Q7 Quattro SUV. The infection chain abused Webhook.site and ImgBB and ultimately deployed the HeadLace backdoor on Windows systems.
As of December 2023, IBM X-Force uncovered a highly targeted campaign using authentic lure documents themed around the Israel–Hamas war to deliver the ITG05-exclusive HeadLace backdoor. The operation appeared aimed at entities influencing humanitarian aid allocation, primarily in Europe, with targets identified across at least 13 countries.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
3 references tracked. Mallory keeps watching after this page renders.
securityintelligence.com
Open sourceunit42.paloaltonetworks.com
Open sourceproofpoint.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Unit 42 reported that **Cloaked Ursa**—also tracked as **APT29**, **Midnight Blizzard**, **Nobelium**, and **Cozy Bear**—ran phishing campaigns against diplomatic targets in **Ukraine** and **Turkey**, using lures tied to diplomats’ personal and professional interests. In one operation, the group repurposed a legitimate BMW-for-sale flyer originally sent by a Polish Ministry of Foreign Affairs diplomat and redistributed malicious versions to diplomatic missions in Kyiv, reaching at least **22 foreign missions**. A separate campaign targeted the **Turkish Ministry of Foreign Affairs** with a lure themed around humanitarian assistance guidance following the February 2023 earthquakes. The phishing chain redirected victims through URL shorteners to a compromised website that delivered malware through **HTA**, **ISO**, and **LNK** files disguised as PNG images, followed by **DLL sideloading**. Researchers said the payload used the **Microsoft Graph API** and **Dropbox** for command-and-control and shared code and tradecraft with previously reported Cloaked Ursa tooling, including overlap with **QUARTERRIG**, use of `APPVISVSUBSYSTEMS64.dll`, anti-analysis checks, shellcode injection, and obfuscated final-stage payloads. The activity showed a shift toward broadly appealing but individually relevant lures designed to spread more easily within diplomatic circles and improve espionage success.
Aug 14, 2026
APT28, also tracked as **Sofacy**, **Fancy Bear**, **Sednit**, and **Strontium**, conducted sustained cyber-espionage operations against political, government, telecommunications, aerospace, and Ukraine-linked targets using spear phishing, typosquatted sites, exploit delivery, and custom malware. Reporting tied the group to campaigns that deployed first-stage downloaders, backdoors, credential-dumping tools, exfiltration modules, and the **Seduploader** malware family, including a macro-enabled Word lure themed around a cybersecurity conference that executed `rundll32.exe` to install persistence and enable screenshot capture, file download, code execution, and data theft. Separate analysis also documented **Fysbis**, a Linux backdoor linked to Sofacy infrastructure, showing the group’s cross-platform capability and continued use of modular implants for covert access. Defenders and platform operators responded with both technical guidance and infrastructure disruption. The UK’s NCSC published indicators of compromise and detection guidance for APT28 malware including **X-Tunnel**, **X-Agent**, and **CompuTrace**, while Microsoft said it obtained a court order to seize seven domains used by the group and redirect them to a sinkhole after the infrastructure was used to target Ukrainian institutions as well as U.S. and EU government and think-tank networks for persistent access and exfiltration. Across the referenced reporting, APT28’s operations were characterized by curated targeting, evolving malware variants, and repeated use of attacker-controlled domains and command-and-control systems to support intelligence collection.
Aug 15, 2026
Researchers and U.S. authorities reported multiple spearphishing campaigns linked with moderate confidence to **APT29/Nobelium/Cozy Bear** that targeted government agencies, NGOs, research institutions, embassies, and other high-value organizations. In one campaign, emails impersonating **USAID** used **Constant Contact** links to deliver malicious ISO files containing a decoy PDF, a weaponized **`.lnk`** shortcut, and a DLL loader that launched **Cobalt Strike Beacon** through `rundll32.exe`; CISA said the beacon used HTTP traffic disguised as requests for **`.woff2`** files and embedded metadata in a `_cfuid` cookie while contacting infrastructure including **theyardservice.com** subdomains and **worldhomeoutlet.com**. Volexity also identified a second-stage malware family, **FRESHFIRE**, which retrieved encrypted payloads from Firebase and decrypted them with host-specific logic before deleting the remote content. The activity fit a broader pattern seen in earlier and later operations attributed to the same cluster. FireEye documented a separate campaign in which attackers impersonated the **U.S. Department of State**, delivered ZIP archives with malicious shortcuts, used PowerShell to drop a decoy document, and installed Cobalt Strike Beacon communicating with **pandorasong.com** via a modified malleable C2 profile. Fortinet later described embassy-focused phishing that used **HTML smuggling** to build an ISO on the victim system, then relied on shortcut-triggered DLL execution to deploy another beacon, showing continued reuse of ISO-based delivery, decoy documents, and staged loaders across politically themed intrusion attempts.
Aug 15, 2026