Diplomats Beware: Cloaked Ursa Phishing With a Twist
Summary: Unit 42 researchers observed Cloaked Ursa, the SVR-linked group also tracked as APT29 and Midnight Blizzard, targeting at least 22 of more than 80 foreign missions in Kyiv with phishing lures built around a used BMW 5-series sedan advertised for sale by a Polish diplomat. The group repurposed the legitimate mid-April 2023 flyer, emailed its own version on May 4, 2023, and used shortened URLs to redirect victims to a coopted site that delivered a malicious payload disguised as high-quality photos.
Why it matters: Reaching 22 of 80 missions in one campaign is a striking scope for a clandestine APT, and roughly 20% of the targeted addresses were unpublished, indicating the attackers combined collected intelligence with public embassy contacts to build their list.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Threat Actors & Nation-State
- Related
- University of Texas at Arlington warns personal information stolen during cyberattack Cyber Risks · Nov 13, 2026Hackers Exploit PHP2Shell Flaws in Check Point Gateways to Deploy TSGA Backdoor and Wipe ESXi Files Cyber Risks · Nov 13, 2026Hackers compromise 4,800 GitHub accounts to steal cloud credentials Cyber Risks · Nov 12, 2026