Loading story…
Poland’s CERT.PL and the Military Counterintelligence Service disclosed a phishing-based espionage campaign targeting diplomatic personnel and attributed it to APT29, also tracked as Nobelium and Cozy Bear. The operation used phishing lures to deliver multiple malware families, including HALFRIG, QUARTERRIG, and SNOWYAMBER, with ENVYSCOUT commonly serving as the delivery script before follow-on activity involving Cobalt Strike or Brute Ratel.
SecurityScorecard’s STRIKE Team reviewed related indicators and network traffic tied to the campaign but said the infrastructure evidence was not conclusive because the same hosting IPs also supported unrelated domains and much of the observed traffic traversed large hosting providers. Even so, some transfer patterns involving IP space in the United States, United Kingdom, and Germany were assessed as potentially consistent with diplomatic targeting aligned with Russian intelligence interests.
TTPs, infrastructure, and targeting history in one profile.
5 events from the most recent confirmed update back to the earliest known activity.
Researchers first observed QUARTERRIG in March 2023. The malware shares code overlap with HALFRIG but uses different obfuscation methods.
Analysts first observed the HALFRIG malware family in February 2023. HALFRIG deploys Cobalt Strike and uses encrypted shellcode rather than downloading its second-stage payload through command-and-control.
A new version of SNOWYAMBER with added operational security features appeared in February 2023. The malware is associated with later-stage deployment of Cobalt Strike and BruteRatel.
The malware family SNOWYAMBER was first observed in October 2022. It functions as a dropper and uses Notion for communications.
CERT.PL and Poland’s Military Counterintelligence Service released joint advisories on April 13 about newly observed espionage activity targeting diplomatic personnel through phishing emails. The advisories attributed the campaign to APT29 and documented the malware families HALFRIG, QUARTERRIG, and SNOWYAMBER along with indicators of compromise.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
4 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers and U.S. authorities reported multiple spearphishing campaigns linked with moderate confidence to **APT29/Nobelium/Cozy Bear** that targeted government agencies, NGOs, research institutions, embassies, and other high-value organizations. In one campaign, emails impersonating **USAID** used **Constant Contact** links to deliver malicious ISO files containing a decoy PDF, a weaponized **`.lnk`** shortcut, and a DLL loader that launched **Cobalt Strike Beacon** through `rundll32.exe`; CISA said the beacon used HTTP traffic disguised as requests for **`.woff2`** files and embedded metadata in a `_cfuid` cookie while contacting infrastructure including **theyardservice.com** subdomains and **worldhomeoutlet.com**. Volexity also identified a second-stage malware family, **FRESHFIRE**, which retrieved encrypted payloads from Firebase and decrypted them with host-specific logic before deleting the remote content. The activity fit a broader pattern seen in earlier and later operations attributed to the same cluster. FireEye documented a separate campaign in which attackers impersonated the **U.S. Department of State**, delivered ZIP archives with malicious shortcuts, used PowerShell to drop a decoy document, and installed Cobalt Strike Beacon communicating with **pandorasong.com** via a modified malleable C2 profile. Fortinet later described embassy-focused phishing that used **HTML smuggling** to build an ISO on the victim system, then relied on shortcut-triggered DLL execution to deploy another beacon, showing continued reuse of ISO-based delivery, decoy documents, and staged loaders across politically themed intrusion attempts.
Aug 15, 2026
Unit 42 reported that **Cloaked Ursa**—also tracked as **APT29**, **Midnight Blizzard**, **Nobelium**, and **Cozy Bear**—ran phishing campaigns against diplomatic targets in **Ukraine** and **Turkey**, using lures tied to diplomats’ personal and professional interests. In one operation, the group repurposed a legitimate BMW-for-sale flyer originally sent by a Polish Ministry of Foreign Affairs diplomat and redistributed malicious versions to diplomatic missions in Kyiv, reaching at least **22 foreign missions**. A separate campaign targeted the **Turkish Ministry of Foreign Affairs** with a lure themed around humanitarian assistance guidance following the February 2023 earthquakes. The phishing chain redirected victims through URL shorteners to a compromised website that delivered malware through **HTA**, **ISO**, and **LNK** files disguised as PNG images, followed by **DLL sideloading**. Researchers said the payload used the **Microsoft Graph API** and **Dropbox** for command-and-control and shared code and tradecraft with previously reported Cloaked Ursa tooling, including overlap with **QUARTERRIG**, use of `APPVISVSUBSYSTEMS64.dll`, anti-analysis checks, shellcode injection, and obfuscated final-stage payloads. The activity showed a shift toward broadly appealing but individually relevant lures designed to spread more easily within diplomatic circles and improve espionage success.
Aug 14, 2026
Researchers linked multiple highly targeted phishing campaigns to **Fighting Ursa / APT28** and related tracking names including **ITG05**, **Fancy Bear**, and **Forest Blizzard**, using tailored geopolitical and diplomatic lures to deliver the **HeadLace** backdoor. In one operation, attackers sent a fake **"Diplomatic Car For Sale"** advertisement for an Audi Q7 to likely diplomatic targets, leading victims to a ZIP archive containing a double-extension executable disguised as an image. The malware chain abused legitimate services such as **Webhook.site** and **ImgBB**, sideloaded a malicious `WindowsCodecs.dll` through a legitimate `calc.exe`, and used a batch script to launch Microsoft Edge with Base64-encoded content to fetch and run a second-stage payload. A separate campaign used authentic-looking documents themed around the **Israel-Hamas conflict** to target academic, finance, diplomatic, and policy-linked organizations involved in humanitarian aid and foreign-policy decision-making, primarily in Europe. IBM said the infrastructure applied country-based filtering so only intended victims in specific countries could retrieve the malware, with targets identified across at least **13 countries**, including several **UN Human Rights Council** members. Across the reporting, **HeadLace** was described as closely associated with this actor set, reinforcing assessments that the activity supported selective intelligence collection against diplomatic and policy-focused entities.
Aug 15, 2026