Reuters: hackers attacked foreign diplomats in Kyiv through BMW ads

Hackers, who may be linked to the Russian Foreign Intelligence Service, injected malware into a Polish diplomat’s advertisement for the sale of a BMW car in order to obtain the data of foreign diplomats in Ukraine. About it with reference to the report of the company on cybersecurity of Palo Alto Networks writes Reuters.

“Espionage activity” was directed against 22 of the approximately 80 diplomatic missions in Kyiv.

In April 2023, a diplomat from Poland sent an email advertisement to various embassies selling a BMW 5 Series sedan, the report says. The diplomat confirmed the fact of sending messages. The APT29 hacker group, also known as Cozy Bear, intercepted the information and injected malware into it. Subsequently, the “infected” messages were sent to other foreign diplomats in Kyiv.

The campaign, which began with a “harmless event,” is “staggering in scope,” the report notes. The hackers advertised the vehicle at a lower price, tempting more people to download the photos and, along with them, malware that would give them remote access to the diplomats’ computers.

The embassies did not comment on the information about the work of hackers. The US State Department explained to the agency that they were aware of the situation, but it did not affect the work of US missions.

June in the USA reportedthat several US government agencies were affected by a “global” cyberattack. Hackers used a vulnerability in software that is “widely” used in the US to access data. CNN then wrote that it is not yet clear whether the hackers have links to the Russian-speaking group Clop, which had previously claimed responsibility for hacking the MOVEit Transfer software.