Sofacy Attacks Multiple Government Entities
Summary: In early February 2018, Unit 42 discovered a Sofacy (APT28/Fancy Bear) phishing campaign targeting two Ministries of Foreign Affairs, one in Europe and one in North America, using a spoofed Jane's 360 sender address and the subject line "Upcoming Defense events February 2018." The attached Excel document hid its text in white font until macros were enabled, then pulled a base64 payload from cells in column 170, decoded it with certutil, and dropped a loader that installed a SofacyCarberp variant communicating with the C2 domain cdnverify[.]net, registered on January 30, 2018.
Bottom line: Sofacy registered cdnverify[.]net on January 30 and launched the attack two days later, and Unit 42 notes the group keeps reusing exposed tooling and methods, which suggests the attempts are still succeeding despite public threat intelligence.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Threat Actors & Nation-State
- Related
- University of Texas at Arlington warns personal information stolen during cyberattack Cyber Risks · Nov 13, 2026Hackers Exploit PHP2Shell Flaws in Check Point Gateways to Deploy TSGA Backdoor and Wipe ESXi Files Cyber Risks · Nov 13, 2026Hackers compromise 4,800 GitHub accounts to steal cloud credentials Cyber Risks · Nov 12, 2026