Fighting Ursa Luring Targets With Car for Sale
ID: 22df2bd5-5e7c-57e3-9c04-5cc483647598
STIX ID: report--22df2bd5-5e7c-57e3-9c04-5cc483647598
Feed Name: Palo Alto Networks Unit 42
Threat Score
Unit 42 reports that the Russian-linked APT Fighting Ursa executed a March 2024 campaign targeting diplomats by abusing free web services to host a "Diplomatic Car For Sale" lure that delivered the HeadLace modular backdoor via a ZIP containing a calc.exe sideloaded DLL and a BAT downloader; the report includes a full infection-chain analysis, multiple IoCs (file hashes and URLs), attribution rationale (TTPs and malware family), and recommended detections and mitigations.
Your team is not currently subscribed to this feed. You must subscribe to it in order to see this post.