BlueBravo Deploys GraphicalProton Backdoor Against European Diplomatic Entities

Share:

The Russian nation-state actor known as BlueBravo has been observed targeting diplomatic entities throughout Eastern Europe with the goal of delivering a new backdoor called GraphicalProton, exemplifying the continuous evolution of the threat.

The phishing campaign is characterized by the use of legitimate internet services (LIS) for command-and-control (C2) obfuscation, Recorded Future said in a new report published Thursday. The activity was observed between March and May 2023.

BlueBravo, also known by the names APT29, Cloaked Ursa, and Midnight Blizzard (formerly Nobelium), is attributed to Russia’s Foreign Intelligence Service (SVR), and has in the past used Dropbox, Firebase, Google Drive, Notion, and Trello to evade detection and stealthily establish communications with infected hosts.

To that end, GraphicalProton is the latest addition to a long list of malware targeting diplomatic organizations after GraphicalNeutrino (aka SNOWYAMBER), HALFRIG, and QUARTERRIG.

Unlike GraphicalNeutrino, which used Notion for C2, GraphicalProton uses Microsoft’s OneDrive or Dropbox for communication, the cybersecurity firm said.

This marks an attempt on the part of BlueBravo operators to not only diversify their tooling but also expand the portfolio of services misused for targeting organizations that are of strategic interest to the nation.

BlueBravo appears to prioritize cyber espionage efforts against European government sector entities, possibly due to the Russian government’s interest in strategic data during and after the war in Ukraine.

The new malware strain, like GraphicalNeutrino, functions as a loader and is staged within an ISO or ZIP file delivered via a phishing email bearing vehicle-themed lures, overlapping with an intrusion set reported by Palo Alto Networks Unit 42 earlier this month.

The ISO files contain .LNK files that masquerade as .PNG images of a BMW car that’s purportedly for sale, which, when clicked, lead to the deployment of GraphicalProton for follow-on exploitation. This is achieved by using Microsoft OneDrive as C2 and periodically polling a folder in the storage service to fetch additional payloads.

It is imperative for network defenders to be aware of the possibility of the misuse of these services within their enterprise and to recognize instances in which they may be used in similar efforts to exfiltrate information, researchers said.

The development comes as the Computer Emergency Response Team of Ukraine (CERT-UA) warned of ongoing phishing attacks undertaken by a group called UAC-0006 group, which the agency said is intensifying efforts to entice users into installing a backdoor known as SmokeLoader.

As the conflict in Ukraine persists and evolving developments within the West and Eastern Europe threaten to alter the geopolitical landscape, Russian state-sponsored groups are expected to continue and even intensify their efforts to target diplomatic missions and high-value targets.

 

(c) Thin

Leave a Comment

Your email address will not be published. Required fields are marked *

loader-image
London, GB
10:27 pm, Jul 7, 2025
weather icon 17°C
L: 16° | H: 18°
broken clouds
Humidity: 62 %
Pressure: 1014 mb
Wind: 14 mph WNW
Wind Gust: 0 mph
UV Index: 0
Precipitation: 0 mm
Clouds: 70%
Rain Chance: 0%
Visibility: 10 km
Sunrise: 4:52 am
Sunset: 9:18 pm
DailyHourly
Daily ForecastHourly Forecast
Tomorrow 10:00 pm
weather icon
16° | 18°°C 0.34 mm 34% 11 mph 77 % 1019 mb 0 mm/h
Wed Jul 09 10:00 pm
weather icon
15° | 26°°C 0.2 mm 20% 7 mph 65 % 1022 mb 0 mm/h
Thu Jul 10 10:00 pm
weather icon
19° | 31°°C 0 mm 0% 6 mph 74 % 1023 mb 0 mm/h
Fri Jul 11 10:00 pm
weather icon
20° | 31°°C 0 mm 0% 10 mph 66 % 1022 mb 0 mm/h
Sat Jul 12 10:00 pm
weather icon
19° | 29°°C 0 mm 0% 10 mph 70 % 1020 mb 0 mm/h
Tomorrow 1:00 am
weather icon
14° | 16°°C 0.2 mm 20% 11 mph 65 % 1014 mb 0 mm/h
Tomorrow 4:00 am
weather icon
11° | 13°°C 0.34 mm 34% 11 mph 77 % 1015 mb 0 mm/h
Tomorrow 7:00 am
weather icon
13° | 13°°C 0 mm 0% 10 mph 69 % 1016 mb 0 mm/h
Tomorrow 10:00 am
weather icon
18° | 18°°C 0 mm 0% 9 mph 47 % 1017 mb 0 mm/h
Tomorrow 1:00 pm
weather icon
23° | 23°°C 0 mm 0% 8 mph 33 % 1018 mb 0 mm/h
Tomorrow 4:00 pm
weather icon
24° | 24°°C 0 mm 0% 7 mph 29 % 1017 mb 0 mm/h
Tomorrow 7:00 pm
weather icon
24° | 24°°C 0 mm 0% 7 mph 29 % 1017 mb 0 mm/h
Tomorrow 10:00 pm
weather icon
20° | 20°°C 0 mm 0% 5 mph 41 % 1019 mb 0 mm/h
Name Price24H (%)
Bitcoin(BTC)
€91,982.36
-1.22%
Ethereum(ETH)
€2,155.96
-1.57%
Tether(USDT)
€0.85
-0.01%
XRP(XRP)
€1.94
-0.60%
Solana(SOL)
€126.39
-2.84%
USDC(USDC)
€0.85
0.00%
Dogecoin(DOGE)
€0.141939
-3.08%
Shiba Inu(SHIB)
€0.000010
-2.99%
Pepe(PEPE)
€0.000009
-3.96%
Scroll to Top