NATO-aligned countries’ foreign affairs ministries have been targeted by a new phishing campaign deploying a Duke malware variant, which has been linked to Russian state-backed cyberespionage operation APT29, also known as Cozy Bear, BlueBravo, Cloaked Ursa, The Dukes, Midnight Blizzard, and Iron Hemlock, The Hacker News reports. Attacks commence with emails containing PDF documents leveraging diplomatic lures, which launches a malicious HTML dropper before executing a JavaScript code that then prompts the installation of the Duke malware, according to an EclecticIQ.

Source: SC Magazine