Cloaked Ursa

Cloaked Ursa, also known as APT29, BlueBravo, Midnight Blizzard, and formerly Nobelium, is a Russian threat actor believed to be associated with Russia's Foreign Intelligence Service (SVR). The group has been active in conducting cyber-espionage attacks against various diplomatic entities throughout Eastern Europe. Their sophisticated techniques include using popular cloud storage platforms such as Dropbox for Command and Control (C2) servers to stealthily establish communications with infected hosts, thereby evading detection. In July 2023, Unit42 reported on Cloaked Ursa's unique approach of repurposing a BMW car advertisement to target diplomats working at embassies in Ukraine. This campaign, dubbed the "BMW Campaign," began in May 2023 and targeted Western diplomats from countries including the U.S., Canada, Spain, and the Netherlands. The attackers co-opted a legitimate site to download a malicious payload when users interacted with the lure, demonstrating their ability to exploit everyday online activities for malicious purposes. The group's tactics have shown a significant degree of code overlap with other known Cloaked Ursa malware, indicating a consistent development approach. Furthermore, the group's actions are part of a broader trend of threat actors employing creative lures to entice victims into engaging with malicious content. As such, Cloaked Ursa continues to pose a substantial threat to diplomatic missions and other sensitive targets, necessitating ongoing vigilance and robust cybersecurity measures.