According to research by Palo Alto’s Unit 42, the most recent campaign by advanced persistent threat Cloaked Ursa (aka APT 20, Nobelium, or Cozy Bear), “demonstrate[s] sophistication and the ability to rapidly integrate popular cloud storage services to avoid detection.” Cloaked Ursa is believed to be affiliated with the Russian government.

Unit 42 found that Cloaked Ursa “leveraged Google Drive cloud storage services for the first time. The ubiquitous nature of Google Drive cloud storage services—combined with the trust that millions of customers worldwide have in them-make their inclusion in this APT’s malware delivery process exceptionally concerning” because “when the use of trusted services is combined with encryption,…it becomes extremely difficult for organizations to detect malicious activity in connection with the campaign.”

Unit 42 discovered Cloaked Ursa was using an agenda for an upcoming meeting with an ambassador as a lure targeting “Western diplomatic missions between May and June 2022” through phishing campaigns. The phishing documents “contained a link to a malicious HTML file (EnvyScout) that served as a dropper for additional malicious files in the target network, including a Cobalt Strike payload.”

Unit 42 provided information about its findings to cloud storage providers and has provided observations, courses of action, and IoCs, which can be accessed here.