Russian hackers have carried out a cyber attack on dozens of diplomatic headquarters located in Ukraine, among them the Albanian embassy.
The group known by the nickname "APT", but also by other names such as "APT29", "Nobelium" or "Cozy Bear", and which has the support of Russian intelligence, is reported to have targeted foreign diplomats working in Ukraine.
Foreign media reports that a notice was sent to the e-mail of the ambassadors, as if a Polish diplomat wanted to sell his car "BMW Series 5".
According to the Palo Alto-based Unit 42 agency, the original and genuine e-mail was sent by the Foreign Ministry office in Poland. Here the hackers were able to intervene by removing the original notification, which they replaced with a virus camouflaged as text in "Word".
“ BMW 5 for sale in Kyiv – 2023.docx ”, was the document that was sent to the embassies, and when clicked it offered a link where you could see more photos of the car for sale, but after downloading, these photos were viruses disguised as “ .png " since when they were clicked they secretly installed the spy system on the computer.
Embassies known to have been targeted are those of Albania, Argentina, Canada, Cyprus, Denmark, Estonia, Greece, Iraq, Ireland, Kuwait, Kyrgyzstan, Latvia, Libya, Netherlands, Norway, Slovakia, Spain, Sudan, Turkey, Turkmenistan, USA and Uzbekistan.
Diplomatic missions are a high-value target for Russian intelligence, and 16 months after the war in Ukraine, it's easy to see why Cozy Bear might have been tasked with infiltrating such organizations.
Cozy Bear itself is known as a highly skilled and extremely innovative group that constantly modifies its approaches to increase effectiveness, taking advantage of every opportunity it can find.