Phishing in the Service of Espionage
Reuters describes a cyberespionage campaign carried out by the hitherto little-known threat group researchers track as “Cold River.” The group is circumstantially but convincingly linked to Russian intelligence services (possibly the FSB, although that’s unclear) through its Russophone operations and the location of at least one of its personnel in the northern city of Syktyvkar, capital of the Komi region. The effort involved attempted social engineering of US nuclear researchers at the Department of Energy’s Brookhaven, Argonne, and Lawrence Livermore National Laboratories. The campaign peaked in August and September, as Russian President Putin’s nuclear threats reached their peak. It’s unknown whether the campaign enjoyed any success: Reuters says that both the Department of Energy and the FSB declined to comment. The report says:
“Cold River, which first appeared on the radar of intelligence professionals after targeting Britain’s foreign office in 2016, has been involved in dozens of other high-profile hacking incidents in recent years, according to interviews with nine cybersecurity firms. Reuters traced email accounts used in its hacking operations between 2015 and 2020 to an IT worker in the Russian city of Syktyvkar.
“’This is one of the most important hacking groups you’ve never heard of,’ said Adam Meyers, senior vice president of intelligence at U.S. cybersecurity firm CrowdStrike. “’They are involved in directly supporting Kremlin information operations.’”
Roger Grimes, Data-Driven Defense Evangelist at KnowBe4, commented on the social-engineering aspect of the campaign. “Hopefully all employees in our nation’s critical infrastructure are already using phishing-resistant multi-factor authentication,” he said. “That will put down a large percentage of phishing attacks, but we can expect Russian phishing campaigns to keep getting more sophisticated over time. That’s why all organizations should aggressively train their employees in how to recognize, stop, and report phishing attacks.”
We call this process “social engineering,” and it’s become prominent in cyberspace, but it really represents an update of old spycraft: identify, approach, compromise, and recruit a target. Counterintelligence officers might take note: new-school security awareness training can help make your people more resistant to the adversary.
US News carries the Reuters story.
Free Phishing Security Test
Would your users fall for convincing phishing attacks? Take the first step now and find out before bad actors do. Plus, see how you stack up against your peers with phishing Industry Benchmarks. The Phish-prone percentage is usually higher than you expect and is great ammo to get budget.
Here’s how it works:
- Immediately start your test for up to 100 users (no need to talk to anyone)
- Select from 20+ languages and customize the phishing test template based on your environment
- Choose the landing page your users see after they click
- Show users which red flags they missed, or a 404 page
- Get a PDF emailed to you in 24 hours with your Phish-prone % and charts to share with management
- See how your organization compares to others in your industry
PS: Don’t like to click on redirected buttons? Cut & Paste this link in your browser: https://info.knowbe4.com/phishing-security-test-partner?partnerid=001a000001lWEoJAAW