APT29 attacks Embassies using CVE-2023-38831 - report

This report details a cross-country APT29 campaign using CVE-2023-38831 in WinRAR to deliver a lure PDF from themed RAR archives ("DIPLOMATIC-CAR-FOR-SALE-BMW.rar"), execute PowerShell to retrieve a next-stage payload hosted via an ngrok subdomain, and target embassies and international organizations in Azerbaijan, Greece, Romania, and Italy; the document provides IoCs (filenames, hashes, URL/domain, email), attack timeline, and mitigation advice to update WinRAR to 6.23+.