Reuters describes a cyberespionage campaign carried out by the hitherto little-known threat group researchers track as "Cold River." The group is circumstantially but convincingly linked to Russian intelligence services (possibly the FSB, although that's unclear) through its Russophone operations and the location of at least one of its personnel in the northern city of Syktyvkar, capital of the Komi region. The effort involved attempted social engineering of US nuclear researchers at the Department of Energy's Brookhaven, Argonne, and Lawrence Livermore National Laboratories. The campaign peaked in August and September, as Russian President Putin's nuclear threats reached their peak. It's unknown whether the campaign enjoyed any success: Reuters says that both the Department of Energy and the FSB declined to comment. The report says:
“Cold River, which first appeared on the radar of intelligence professionals after targeting Britain's foreign office in 2016, has been involved in dozens of other high-profile hacking incidents in recent years, according to interviews with nine cybersecurity firms. Reuters traced email accounts used in its hacking operations between 2015 and 2020 to an IT worker in the Russian city of Syktyvkar.
"’This is one of the most important hacking groups you’ve never heard of,’ said Adam Meyers, senior vice president of intelligence at U.S. cybersecurity firm CrowdStrike. "’They are involved in directly supporting Kremlin information operations.’"
Roger Grimes, Data-Driven Defense Evangelist at KnowBe4, commented on the social-engineering aspect of the campaign. “Hopefully all employees in our nation's critical infrastructure are already using phishing-resistant multi-factor authentication," he said. "That will put down a large percentage of phishing attacks, but we can expect Russian phishing campaigns to keep getting more sophisticated over time. That's why all organizations should aggressively train their employees in how to recognize, stop, and report phishing attacks."
We call this process “social engineering,” and it’s become prominent in cyberspace, but it really represents an update of old spycraft: identify, approach, compromise, and recruit a target. Counterintelligence officers might take note: new-school security awareness training can help make your people more resistant to the adversary.
US News carries the Reuters story.
Here's how it works:
