BlueBravo Adapts to Target Diplomatic Entities with GraphicalProton Malware

Recorded Future’s Insikt Group attributes a Russian-aligned actor called BlueBravo with delivering a new malware variant, GraphicalProton, which uses cloud storage services (OneDrive, Dropbox) for command-and-control instead of Notion used by GraphicalNeutrino. The group leverages compromised websites, themed lures, and multiple evasion/persistence techniques to target diplomatic and foreign-policy entities in Eastern Europe. #BlueBravo #GraphicalProton #GraphicalNeutrino #APT29 #MidnightBlizzard #RecordedFuture #OneDrive #Dropbox

Keypoints

BlueBravo is a Russian-aligned APT tracked by Recorded Future’s Insikt Group and shows activity similar to APT29 and Midnight Blizzard.
Insikt Group discovered a new variant, GraphicalProton, which uses OneDrive or Dropbox for C2; GraphicalNeutrino previously used Notion for C2.
The group delivers malware via themed lures and compromised websites, reusing lure themes to improve targeting against diplomatic and foreign-policy organizations.
BlueBravo regularly misuses legitimate internet services (Trello, Firebase, Dropbox, Notion, OneDrive) to obfuscate C2 traffic and evade detection.
Observed technical techniques include HTML smuggling, DLL side-loading/search-order hijacking, Right-to-Left override, dynamic API resolution, and registry startup persistence.
Recorded Future expects continued evolution of malware variants and infrastructure, emphasizing the need for defenders to monitor LIS abuse and compromised sites.

MITRE Techniques

[T1584] Compromise Infrastructure – BlueBravo uses compromised websites and infrastructure to host lures and deploy payloads. (‘Compromise Infrastructure’)
[T1204.002] User Execution: Malicious File – Delivery relies on user-opening of malicious files delivered via themed lures. (‘User Execution: Malicious File’)
[T1547.001] Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder – Malware establishes persistence via registry run keys or startup entries. (‘Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder’)
[T1027.006] Obfuscated Files or Information: HTML Smuggling – Payloads are delivered using HTML smuggling techniques to evade detection. (‘Obfuscated Files or Information: HTML Smuggling’)
[T1027.007] Obfuscated Files or Information: Dynamic API Resolution – Samples perform dynamic API resolution to hinder static analysis. (‘Obfuscated Files or Information: Dynamic API Resolution’)
[T1036.002] Masquerading: Right-to-Left Override – Attack artifacts use name-masking techniques such as right-to-left override to masquerade as benign files. (‘Masquerading: Right-to-Left Override’)
[T1036.005] Masquerading: Match Legitimate Name or Location – Files are given legitimate-looking names/locations to blend with benign software. (‘Masquerading: Match Legitimate Name or Location’)
[T1140] Deobfuscate/Decode Files or Information – Malware deobfuscates or decodes embedded payloads at runtime. (‘Deobfuscate/Decode Files or Information’)
[T1574.001] Hijack Execution Flow: DLL Search Order Hijacking – Attackers abuse DLL search order to redirect execution to malicious libraries. (‘Hijack Execution Flow: DLL Search Order Hijacking’)
[T1574.002] Hijack Execution Flow: DLL Side-Loading – DLL side-loading is used to run malicious code under the guise of legitimate binaries. (‘Hijack Execution Flow: DLL Side-Loading’)
[T1562.001] Impair Defenses: Disable or Modify Tools – Samples include behavior to disable or modify defensive tools on compromised hosts. (‘Impair Defenses: Disable or Modify Tools’)
[T1033] System Owner/User Discovery – Malware collects information about the system user to support targeting and footprinting. (‘System Owner/User Discovery’)
[T1082] System Information Discovery – Samples gather system information to tailor follow-on activity. (‘System Information Discovery’)
[T1071.001] Application Layer Protocol: Web Protocols – C2 communications occur over standard web protocols to blend with normal traffic. (‘Application Layer Protocol: Web Protocols’)
[T1102.002] Web Service: Bidirectional Communication – Cloud storage and web services (OneDrive, Dropbox, Notion) are used for bidirectional C2. (‘Web Service: Bidirectional Communication’)
[T1105] Ingress Tool Transfer – Tools and payloads are transferred into victims using ingress mechanisms, including cloud-hosted files. (‘Ingress Tool Transfer’)

Indicators of Compromise

[Domains] compromised domains used to host lures/payloads – te-as[.]no, easym6[.]com, and 7 more domains observed
[URLs] access points associated with activity – te-as[.]no/wine[.]php, reidao[.]com/dashboard.php, and 7 more URLs observed
[File hashes] sample hashes tied to GraphicalProton/associated payloads – 9da5339a5a7519b8b639418ea34c9a95f1189273, 22b037f0a42579b45530bed196dd2b47fd4d4dff, and dozens of additional hashes
[File names/paths] filenames and artifacts observed on compromised hosts – AppvIsvSubsystems64.dll, Note.exe, plus many .lnk/.iso files and $Recycle.Bin artifacts

Recorded Future’s technical analysis shows BlueBravo’s operational procedure begins with targeted lures delivered through compromised websites and themed spearphishing assets. Those lures host or download obfuscated payloads (HTML smuggling delivery) packaged as ISO, ZIP, or shortcut (.lnk) files; users executing these malicious files trigger user-execution chains that deploy GraphicalProton or related loaders. In several samples attackers use Right-to-Left override and legitimate-looking filenames/locations to masquerade artifacts and rely on dynamic API resolution and runtime deobfuscation to frustrate static detection.

Post‑execution behavior includes establishing persistence via registry Run keys or startup entries and abusing DLL search-order hijacking and side-loading to load malicious libraries under trusted binaries. The malware performs host discovery (system owner and system information), attempts to disable or modify defensive tools, and stages additional payloads via ingress tool transfer. For command-and-control, BlueBravo shifts among legitimate internet services — historically Notion for GraphicalNeutrino and now OneDrive/Dropbox for GraphicalProton — using standard web protocols and web-service bidirectional channels to blend C2 with normal traffic and exfiltrate data.

Defensive focus should be on monitoring LIS usage for anomalous API/file-access patterns, validating downloads from compromised domains and URLs (listed in IOCs), scanning incoming ISO/ZIP/LNK artifacts and executable DLLs for known hashes and suspicious side-loading behavior, and hardening endpoints against registry autoruns and DLL hijacking. Continuous tracking of compromised infrastructure and evolving lure themes is advised, as BlueBravo is likely to iterate on payload delivery, persistence, and C2 mechanisms to evade detection.

BlueBravo Adapts to Target Diplomatic Entities with GraphicalProton Malware | Recorded Future