Cloaked Ursa Diplomatic Phishing Campaign
## Cloaked Ursa: Targeting Diplomatic Missions with Phishing Lures **Summary:** Cloaked Ursa, a hacking group associated with Russia's Foreign Intelligence Service, has been persistently targeting diplomatic missions globally. Using phishing tactics, Their initial access attempts over the past two years have predominantly used phishing lures with a theme of diplomatic operations such as the following: - Notes verbale (semiformal government-to-government diplomatic communications) - Embassies’ operating status updates - Schedules for diplomats - Invitations to embassy events Recently, Unit42 researchers observed a shift in their strategy, with a focus on targeting diplomats themselves. In Kyiv alone, at least 22 out of over 80 foreign missions were targeted. **This playbook should be triggered manually or can be configured as a job.** Please create a new incident and choose the Cloaked Ursa (APT29) Diplomatic Phishing Campaign playbook and Rapid Breach Response incident type. **The playbook includes the following tasks:** **IoCs Collection** - Blog IoCs download **Hunting:** - Cortex XDR XQL exploitation patterns hunting - Advanced SIEM exploitation patterns hunting - Indicators hunting The hunting queries are searching for the following activities: - Related LNK files execution command line - Dropped file names **Mitigations:** - Unit42 mitigation measures **References:** [Diplomats Beware: Cloaked Ursa Phishing With a Twist](https://unit42.paloaltonetworks.com/cloaked-ursa-phishing/)
- Pack
- CloakedUrsaPhishingCampaign
- Tasks
- 42
Inputs
- PlaybookDescription — The playbook description to be used in the Rapid Breach Response - Set Incident Info sub-playbook.
- autoBlockIndicators — Wether to block the indicators automatically.
- QRadarTimeRange — The time range for the QRadar queries.
- SplunkEarliestTime — The time range for the Splunk queries.
- ElasticEarliestTime — The time range for the Elastic queries.
- LogAnalyticsTimespan — The time range for the Azure Log Analytics queries.
- XQLTimeRange — The time range for the XQL queries.
- ElasticIndex — The elastic index to search in.
- emailIndicators — The email indicators provided in the blog.
Commands used
- azure-log-analytics-execute-query
- closeInvestigation
- es-eql-search
- splunk-search
- xdr-xql-generic-query