A Russian threat actor Palo Alto Unit 42 track as Fighting Ursa advertised a car for sale as a lure to distribute HeadLace backdoor malware. The campaign likely targeted diplomats and began as early as March 2024.
Fighting Ursa (aka APT28, Fancy Bear and Sofacy) has been associated with Russian military intelligence and classified as an advanced persistent threat (APT). Diplomatic-car-for-sale phishing lure themes have been used by Russian threat actors for years. These lures tend to resonate with diplomats and get targets to click on the malicious content.
Read more…
Source: Palo Alto
Related:
- China issues report on U.S. CIA’s cyberattacks on other countries
May 4, 2023
China on Thursday released an investigation report revealing an “empire of hackers” of the Central Intelligence Agency (CIA) of the United States, one of the major intelligence agencies of the country’s federal government. Over a long period, the CIA has been secretly orchestrating “peaceful evolution” and “color revolutions” around the world, continuously conducting espionage activities, said ...
- China revises Counter-Espionage Law, defining cyber-attacks against state organs as spy activities
April 26, 2023
The 14th National People’s Congress (NPC) Standing Committee passed an amendment to the Counter-Espionage Law on Wednesday. The revised law refines the definition of espionage activities, explicitly categorizing “collaborating with spy organizations and their agents” and “conducting cyber-attacks against state organs, confidential-related units, or critical information infrastructure and etc.” as espionage activities. The revised law will ...
- Mantis: New Tooling Used in Attacks Against Palestinian Targets
April 4, 2023
The Mantis cyber-espionage group (aka Arid Viper, Desert Falcon, APT-C-23), a threat actor believed to be operating out of the Palestinian territories, is continuing to mount attacks, deploying a refreshed toolset and going to great lengths to maintain a persistent presence on targeted networks. While the group is known for targeting organizations in the Middle East, ...
- APT43: North Korean Group Uses Cybercrime to Fund Espionage Operations
March 28, 2023
Mandiant researchers released a report on APT43, a prolific threat actor operating on behalf of the North Korean regime that they have observed engaging in cybercrime as a way to fund their espionage operations. According to Mandiant they track tons of activity throughout the year, but don’t always have enough evidence to attribute it to a ...
- China used stolen data to expose CIA operatives in Africa and Europe
March 21, 2023
Around 2013, U.S. intelligence began noticing an alarming pattern: Undercover CIA personnel, flying into countries in Africa and Europe for sensitive work, were being rapidly and successfully identified by Chinese intelligence, according to three former U.S. officials. The surveillance by Chinese operatives began in some cases as soon as the CIA officers had cleared passport control. Read ...
- New malware variant has “radio silence” mode to evade detection
March 7, 2023
The Sharp Panda cyber-espionage hacking group is targeting high-profile government entities in Vietnam, Thailand, and Indonesia with a new version of the ‘Soul’ malware framework. The particular malware was previously seen in espionage campaigns targeting critical Southeast Asian organizations, attributed to various Chinese APTs. Read more… Source: Bleeping Computer