BlueBravo Deploys GraphicalProton Backdoor Against European Diplomatic Entities

Share:

The Russian nation-state actor known as BlueBravo has been observed targeting diplomatic entities throughout Eastern Europe with the goal of delivering a new backdoor called GraphicalProton, exemplifying the continuous evolution of the threat.

The phishing campaign is characterized by the use of legitimate internet services (LIS) for command-and-control (C2) obfuscation, Recorded Future said in a new report published Thursday. The activity was observed between March and May 2023.

BlueBravo, also known by the names APT29, Cloaked Ursa, and Midnight Blizzard (formerly Nobelium), is attributed to Russia’s Foreign Intelligence Service (SVR), and has in the past used Dropbox, Firebase, Google Drive, Notion, and Trello to evade detection and stealthily establish communications with infected hosts.

To that end, GraphicalProton is the latest addition to a long list of malware targeting diplomatic organizations after GraphicalNeutrino (aka SNOWYAMBER), HALFRIG, and QUARTERRIG.

Unlike GraphicalNeutrino, which used Notion for C2, GraphicalProton uses Microsoft’s OneDrive or Dropbox for communication, the cybersecurity firm said.

This marks an attempt on the part of BlueBravo operators to not only diversify their tooling but also expand the portfolio of services misused for targeting organizations that are of strategic interest to the nation.

BlueBravo appears to prioritize cyber espionage efforts against European government sector entities, possibly due to the Russian government’s interest in strategic data during and after the war in Ukraine.

The new malware strain, like GraphicalNeutrino, functions as a loader and is staged within an ISO or ZIP file delivered via a phishing email bearing vehicle-themed lures, overlapping with an intrusion set reported by Palo Alto Networks Unit 42 earlier this month.

The ISO files contain .LNK files that masquerade as .PNG images of a BMW car that’s purportedly for sale, which, when clicked, lead to the deployment of GraphicalProton for follow-on exploitation. This is achieved by using Microsoft OneDrive as C2 and periodically polling a folder in the storage service to fetch additional payloads.

It is imperative for network defenders to be aware of the possibility of the misuse of these services within their enterprise and to recognize instances in which they may be used in similar efforts to exfiltrate information, researchers said.

The development comes as the Computer Emergency Response Team of Ukraine (CERT-UA) warned of ongoing phishing attacks undertaken by a group called UAC-0006 group, which the agency said is intensifying efforts to entice users into installing a backdoor known as SmokeLoader.

As the conflict in Ukraine persists and evolving developments within the West and Eastern Europe threaten to alter the geopolitical landscape, Russian state-sponsored groups are expected to continue and even intensify their efforts to target diplomatic missions and high-value targets.

 

(c) Thin

Leave a Comment

Your email address will not be published. Required fields are marked *

loader-image
London, GB
10:15 pm, Jul 6, 2025
weather icon 17°C
L: 16° | H: 18°
broken clouds
Humidity: 70 %
Pressure: 1007 mb
Wind: 4 mph WSW
Wind Gust: 7 mph
UV Index: 0
Precipitation: 0 mm
Clouds: 60%
Rain Chance: 0%
Visibility: 10 km
Sunrise: 4:51 am
Sunset: 9:18 pm
DailyHourly
Daily ForecastHourly Forecast
Tomorrow 10:00 pm
weather icon
16° | 18°°C 0.99 mm 99% 13 mph 92 % 1015 mb 0 mm/h
Tue Jul 08 10:00 pm
weather icon
13° | 24°°C 0.2 mm 20% 11 mph 76 % 1020 mb 0 mm/h
Wed Jul 09 10:00 pm
weather icon
15° | 26°°C 0 mm 0% 6 mph 66 % 1023 mb 0 mm/h
Thu Jul 10 10:00 pm
weather icon
19° | 31°°C 0 mm 0% 8 mph 63 % 1024 mb 0 mm/h
Fri Jul 11 10:00 pm
weather icon
20° | 30°°C 0 mm 0% 12 mph 54 % 1023 mb 0 mm/h
Tomorrow 1:00 am
weather icon
17° | 17°°C 0 mm 0% 9 mph 71 % 1007 mb 0 mm/h
Tomorrow 4:00 am
weather icon
16° | 16°°C 0.31 mm 31% 8 mph 79 % 1007 mb 0 mm/h
Tomorrow 7:00 am
weather icon
14° | 14°°C 0.99 mm 99% 10 mph 92 % 1009 mb 0 mm/h
Tomorrow 10:00 am
weather icon
17° | 17°°C 0.33 mm 33% 12 mph 53 % 1011 mb 0 mm/h
Tomorrow 1:00 pm
weather icon
22° | 22°°C 0 mm 0% 13 mph 37 % 1012 mb 0 mm/h
Tomorrow 4:00 pm
weather icon
20° | 20°°C 0 mm 0% 10 mph 41 % 1013 mb 0 mm/h
Tomorrow 7:00 pm
weather icon
20° | 20°°C 0 mm 0% 7 mph 45 % 1014 mb 0 mm/h
Tomorrow 10:00 pm
weather icon
17° | 17°°C 0 mm 0% 11 mph 49 % 1015 mb 0 mm/h
Name Price24H (%)
Bitcoin(BTC)
€92,351.65
0.61%
Ethereum(ETH)
€2,163.72
1.59%
Tether(USDT)
€0.85
0.00%
XRP(XRP)
€1.93
2.88%
Solana(SOL)
€128.83
3.21%
USDC(USDC)
€0.85
0.00%
Dogecoin(DOGE)
€0.144865
3.94%
Shiba Inu(SHIB)
€0.000010
3.22%
Pepe(PEPE)
€0.000008
4.05%
Scroll to Top