Threat Brief: Sofacy Group Targeting European and North American Diplomats
Summary: Palo Alto Networks Unit 42 reported new Sofacy group attacks using spoofed emails that appear to come from Jane's 360 Defense Events and target foreign affairs agencies and ministries in North America and Europe, including a European embassy in Moscow. The attached Excel spreadsheet opens blank, and clicking "Enable Content" runs a program that silently installs malware giving attackers control of the computer, letting them copy documents, usernames, passwords and account information and take screenshots.
What you should know: Sofacy, which the US Intelligence Community has widely associated with Russia, has hit the International Olympic Committee, the World Anti-Doping Agency and political and military targets across Germany, France, Ukraine and the Netherlands from 2014 through 2018. Unit 42 expects the group to switch to spoofing a different organization once this decoy is public, so the lure your diplomats see next will likely carry a different name.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Threat Actors & Nation-State
- Related
- University of Texas at Arlington warns personal information stolen during cyberattack Cyber Risks · Nov 13, 2026Hackers Exploit PHP2Shell Flaws in Check Point Gateways to Deploy TSGA Backdoor and Wipe ESXi Files Cyber Risks · Nov 13, 2026Hackers compromise 4,800 GitHub accounts to steal cloud credentials Cyber Risks · Nov 12, 2026