Phishing campaigns by the Nobelium intrusion set

ANSSI describes phishing campaigns (since Feb 2021) attributed to the Nobelium intrusion set that compromised email accounts, distributed EnvyScout/BoomBox and Cobalt Strike implants, and targeted diplomatic and public-sector organizations; the report includes MITRE ATT&CK TTP mappings, C2 infrastructure details, domain/IP indicators of compromise, links to public research, and mitigation recommendations.