Fighting Ursa Luring Targets With Car for Sale
Summary: Unit 42 attributed a campaign to the Russian threat actor Fighting Ursa (APT28, Fancy Bear, Sofacy) that used a fake 'Diplomatic Car For Sale' advertisement for an Audi Q7 Quattro SUV to deliver the HeadLace backdoor, likely targeting diplomats and beginning as early as March 2024. The infection chain started at a Webhook.site URL submitted to VirusTotal on March 14, 2024, which returned HTML that checked for Windows, served a decoy image hosted on ImgBB, and downloaded a ZIP containing a .jpg.exe copy of calc.exe that sideloaded a malicious WindowsCodecs.dll and ran a batch file to fetch further content.
What you should know: The group hosted every stage of the attack on free, legitimate services - Webhook.site and ImgBB - so blocking those domains is the practical control, and Unit 42 notes Fighting Ursa kept exploiting known vulnerabilities for 20 months after its cover was blown.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Threat Actors & Nation-State
- Related
- University of Texas at Arlington warns personal information stolen during cyberattack Cyber Risks · Nov 13, 2026Hackers Exploit PHP2Shell Flaws in Check Point Gateways to Deploy TSGA Backdoor and Wipe ESXi Files Cyber Risks · Nov 13, 2026Hackers compromise 4,800 GitHub accounts to steal cloud credentials Cyber Risks · Nov 12, 2026