BlueBravo Adapts to Target Diplomatic Entities with GraphicalProton Malware

Recorded Future Insikt Group reports on BlueBravo (overlapping with APT29/Midnight Blizzard) activity from H1 2023, describing spearphishing-driven campaigns that deliver loaders (GraphicalNeutrino, GraphicalProton, QuarterRig) staged in ISO/ZIP files, use HTML smuggling and compromised websites, and abuse legitimate cloud services (OneDrive, Notion, Dropbox) for command-and-control; the report includes detailed malware behavior, infrastructure IOCs, YARA rules, ATT&CK mappings, and defensive mitigations.