APT28, a Russia-linked threat actor (also known as Fighting Ursa, Fancy Bear, and Sofacy), has been identified in a campaign using a car sale phishing lure to deliver the HeadLace Windows backdoor to target diplomats since March 2024.