December 6, 2022

Volume XII, Number 340

Advertisement

December 06, 2022

Subscribe to Latest Legal News and Analysis

December 05, 2022

Subscribe to Latest Legal News and Analysis
Advertisement

Cloaked Ursa Using Trusted Online Storage Services to Evade Detection

According to research by Palo Alto’s Unit 42, the most recent campaign by advanced persistent threat Cloaked Ursa (aka APT 20, Nobelium, or Cozy Bear), “demonstrate[s] sophistication and the ability to rapidly integrate popular cloud storage services to avoid detection.” Cloaked Ursa is believed to be affiliated with the Russian government.

Unit 42 found that Cloaked Ursa “leveraged Google Drive cloud storage services for the first time. The ubiquitous nature of Google Drive cloud storage services—combined with the trust that millions of customers worldwide have in them-make their inclusion in this APT’s malware delivery process exceptionally concerning” because “when the use of trusted services is combined with encryption,…it becomes extremely difficult for organizations to detect malicious activity in connection with the campaign.”

Unit 42 discovered Cloaked Ursa was using an agenda for an upcoming meeting with an ambassador as a lure targeting “Western diplomatic missions between May and June 2022” through phishing campaigns. The phishing documents “contained a link to a malicious HTML file (EnvyScout) that served as a dropper for additional malicious files in the target network, including a Cobalt Strike payload.”

Unit 42 provided information about its findings to cloud storage providers and has provided observations, courses of action, and IoCs, which can be accessed here.

 

Copyright © 2022 Robinson & Cole LLP. All rights reserved.National Law Review, Volume XII, Number 202
Advertisement
Advertisement
Advertisement

About this Author

Linn F. Freedman, Robinson Cole Law Firm, Cybersecurity and Litigation Law Attorney, Providence
Partner

Linn Freedman practices in data privacy and security law, cybersecurity, and complex litigation. She provides guidance on data privacy and cybersecurity compliance to a full range of public and private clients across all industries, such as construction, education, health care, insurance, manufacturing, real estate, utilities and critical infrastructure, marine, and charitable organizations. Linn is a member of the firm's Business Litigation Group and chairs its Data Privacy + Cybersecurity Team. She is also a member of the Financial Services Cyber-Compliance Team (CyFi ...

401-709-3353
Advertisement
Advertisement
Advertisement