Fighting Ursa

Fighting Ursa, also known as APT28, Fancy Bear, and Sofacy, is a highly active Russian cyber threat actor with a notorious history of carrying out high-profile attacks. The group has been linked to significant cyber offensives including US election interference in 2016, the NotPetya attacks, the Olympic Destroyer effort, and more. Their tactics are consistent across campaigns, and they exclusively use the HeadLace backdoor, which further validates their attribution. One of their key strategies involves disguising malicious files by exploiting Windows' default setting of hiding file extensions, a tactic adopted from other Russian threat actors. In March 2024, Fighting Ursa launched a campaign that leveraged a unique approach: a used car sale phishing scheme aimed at diplomats. This scheme involved the distribution of the HeadLace backdoor malware via a fake car advertisement, demonstrating the group's innovative methods of attack. The attribution of this campaign to Fighting Ursa was made with medium to high confidence by cybersecurity experts. Earlier in May, the threat actor exploited Webhook.site, a legitimate service, to initiate the infection chain by hosting a malicious HTML page. Fighting Ursa continues to be a persistent threat, particularly due to its innovative use of legitimate web services in its attack infrastructure. Cybersecurity experts predict that the group will maintain this strategy in future campaigns. The group's consistent tactics, motivation, and the exclusive use of the HeadLace backdoor indicate that Fighting Ursa remains a significant threat to global cybersecurity.