Ankura CTIX FLASH Update - July 14, 2023

Malware Activity

Cloaked Ursa Targets Diplomats in New Malware Campaign

Threat actors from the Cloaked Ursa (APT29) threat organization have been targeting and exploiting high-level diplomatic figures across the globe in their latest campaign. The group is well known for its consistent diplomatic targeting over the years and using a variety of social lures such as semiformal government communications, embassy operations, scheduling, and invitations to embassy events. However, a new tactic being used by Cloaked Ursa actors involves targeting the diplomatic individual themselves rather than the country they operate under, using personal items such as a new vehicle as social lures. The threat actors used a stolen BMW For Sale posting as the lure and disseminated the posting to diplomats around the world. When users clicked on "more high-quality pictures", they would be sent to a Cloaked Ursa-controlled website where the malicious payload would be downloaded to the