Reddit NetSec

AlienVault OTX General

Reddit InfoSec News

Exploit-DB RSS Feed

CIRCL OSINT Feed

ThreatFox MISP Feed

CVE Database V5

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

NOBELIUM Uses Poland's Ambassador’s Visit to the U.S. to Target EU Governments Assisting Ukraine

The threat campaign attributed to the advanced persistent threat (APT) group known as NOBELIUM (also tracked as UNC2452 and APT29) leverages a geopolitical event—Poland's Ambassador’s visit to the United States—to target European Union governments that are providing assistance to Ukraine. This campaign is characterized by sophisticated spearphishing techniques, including spearphishing links and malicious file attachments delivered via HTML smuggling and obfuscated payloads to evade detection. The attackers exploit trusted relationships and use native APIs to execute code, enabling persistence through mechanisms such as registry run keys and autostart execution. The campaign employs drive-by compromises and web services for command and control, facilitating bidirectional communication with compromised systems. The use of obfuscation techniques and infrastructure compromise further complicates detection and mitigation efforts. The attack chain requires user execution, typically through social engineering, and targets high-value government entities involved in geopolitical support activities. Although no specific software vulnerabilities or affected product versions are listed, the campaign's reliance on social engineering and trusted relationships indicates a focus on human factors and supply chain attack vectors rather than direct exploitation of software flaws. The campaign is ongoing as of the publication date in March 2023, with no patches available, underscoring the need for heightened vigilance and tailored defensive measures.

Detailed information about NOBELIUM Uses Poland's Ambassador’s Visit to the U.S. to Target EU Governments Assisting Ukraine. Get real-time updates, technical de

NOBELIUM Uses Poland's Ambassador’s Visit to the U.S. to Target EU Governments Assisting Ukraine - Live Threat Intelligence - Threat Radar | OffSeq.com

Title	Severity	Type	Source	Date

Threats Tagged 'misp-galaxy:mitre-intrusion-set="unc2452 - g0118"'

Filter Threats