BlueBravo Uses Ambassador Lure to Deploy GraphicalNeutrino Malware

Recorded Future's Insikt Group reports that the threat group BlueBravo (linked to APT29/NOBELIUM) used an embassy-themed "Ambassador" lure and HTML smuggling to deliver a ZIP containing a malicious renamed 7-Zip executable and modified DLLs. The payload, GraphicalNeutrino, is a C++ loader that uses DLL search-order hijacking, anti-analysis techniques, and the Notion API as an innovative C2 channel to stage and retrieve encrypted shellcode; the report provides IoCs, technical analysis, Mitre ATT&CK mappings, a YARA rule, and recommended mitigations.