Fighting Ursa

Fighting Ursa, also known as APT28 or Fancy Bear, is a malicious software (malware) group notorious for conducting attacks on behalf of Russia's military. The group has been involved in numerous cyber campaigns exploiting various vulnerabilities, with the most recent being the Microsoft Outlook vulnerability, tracked as CVE-2023-23397. This specific exploit allows attackers to steal a user's password hash by coercing the victim's Microsoft Outlook client to connect to an attacker-controlled server without user interaction. Unit 42 researchers have identified three distinct campaigns associated with this vulnerability, demonstrating Fighting Ursa's continued exploitation attempts against unpatched or improperly configured systems. Before Russia’s illegal invasion of Ukraine in 2022, Fighting Ursa was primarily recognized for supporting Russian information warfare campaigns, such as creating counter-narratives around Russian Olympic doping and subverting investigations into the poisoning of Russian nationals in England in 2018. However, their activity escalated significantly in September and October, with a spate of attacks exploiting the aforementioned Outlook vulnerability. These campaigns targeted at least 30 organizations across 14 countries, including NATO and a NATO Rapid Deployable Corps, demonstrating the group's extensive reach and persistent threat. Despite the public outing of their techniques and the attribution of the exploit to them, Fighting Ursa continued to use the same tactics in their second and third campaigns. According to Unit 42, this suggests that the access and intelligence generated by these operations outweighed the ramifications of public discovery. On at least one occasion, they directly targeted a NATO Rapid Deployable Corps, underscoring their boldness and disregard for international norms. The tech company tracking these activities under the moniker ITG05 warns organizations of the persistent threat posed by Fighting Ursa and emphasizes the importance of maintaining updated and properly configured systems.