🇷🇺

TAG-53

APT Group Information theft and espionage ETDA ✓

Also Known As 6 names

TA446 BlueCharlie Star Blizzard COLDRIVER Callisto Group SEABORGIUM

Target Countries 16

Countries highlighted in red

Australia Brazil Canada China Germany France United Kingdom India Namibia Nigeria Nepal New Zealand Poland Ukraine United States South Africa

Sectors Targeted

Government Defense-industrial targets Energy Information 51 defense US Department of Energy facilities Energy facilities Computer Systems Design Services 541512 Civil Society National Security and International Affairs 9281 Employment Placement Agencies and Executive Search Services 56131 Finance Personal Care Services 8121 Commodity Contracts Intermediation 523160 Information Security Companies Individual non-governmental organizations Journalists Media Civil Society Organizations Finance and Insurance 52 Non-governmental organizations Personal Finance Other Sensitive Organizations Technology Utilities 22 Think-tanks Sensitive Organizations Electric Power Generation 22111 Professional, Scientific, and Technical Services 54 Computer and Electronic Product Manufacturing 334 Grantmaking and Giving Services 8132 Internet Publishing and Broadcasting and Web Search Portals 51913 NAICS:48 48 Intelligence Investigation, Guard, and Armored Car Services 56161 NGOs Health Care and Social Assistance 62 Educational Services 61 Publishing Industries (except Internet) 511 Information security companies Cryptocurrency Periodical Publishers 51112 academia Management, Scientific, and Technical Consulting Services 5416 Religious, Grantmaking, Civic, Professional, and Similar Organizations 813 National Security and International Affairs 928 Think Tanks Education Think tanks Financial Human Rights Defense Public Administration 92 think tanks Defense Contractors Personal Higher Education Healthcare Corporate Individuals Military Academia Consulting Other Services (except Public Administration) 81 Governmental organizations Journalism Information technology journalists Politicians National Security and International Affairs 928110 Space Research and Technology 927 Political outfits Political governmental organizations Computer Systems Design and Related Services 54151

Details

Origin 🇷🇺 RU

Last Updated 17 Dec 2022

MITRE ATT&CK 32

T1059 T1059.007 T1078 T1078.003 T1105 T1114 T1114.002 T1114.003 T1204 T1204.002 T1210 T1539 T1550 T1550.004 T1566 T1566.001 T1583 T1583.001 T1585 T1585.001 T1585.002 T1586 T1586.002 T1588 T1588.002 T1589 T1593 T1598 T1598.002 T1598.003 T1608 T1608.001

Related Zero-Days

No zero-day CVE linked to this actor

Known Names 16 entries

Cold River Lastline

Nahr el bared original place

Nahr Elbard transliteration

Cobalt Edgewater SecureWorks

TA446 Proofpoint

Seaborgium Microsoft

TAG-53 Recorded Future

BlueCharlie Recorded Future

Blue Callisto PWC

Calisto Sekoia

Star Blizzard Microsoft

UNC4057 Mandiant

IRON FRONTIER SecureWorks

Grey Pro ?

Mythic Ursa Palo Alto

Gossamer Bear CrowdStrike

Observed Target Countries 7

Based on ETDA data — countries highlighted in red

Canada India Lebanon UAE Ukraine USA NATO

Description

(Lastline) While reviewing some network anomalies, we recently uncovered Cold River, a sophisticated threat actor making malicious use of DNS tunneling for command and control activities. We have been able to decode the raw traffic in command and control, find sophisticated lure documents used in the campaign, connect other previously unknown samples, and associate a number of legitimate organizations whose infrastructure is referenced and used in the campaign. The campaign targets Middle Eastern organizations largely from the Lebanon and United Arab Emirates, though, Indian and Canadian companies with interests in those Middle Eastern countries are also targeted. There are new TTPs used in this attack – for example Agent_Drable is leveraging the Django python framework for command and control infrastructure, the technical details of which are outlined later in the blog.

Tools Used 3

DNSpionage LOSTKEYS SPICA

Operations 10

2022-02 Blue Callisto orbits around US Laboratories in 2022 https://www.pwc.com/gx/en/issues/cybersecurity/cyber-threat-intelligence/blue-callisto-orbits-around-us.html

2022-03 COLDRIVER, a Russian-based threat actor sometimes referred to as Calisto, has launched credential phishing campaigns, targeting several US based NGOs and think tanks, the military of a Balkans country, and a Ukraine based defense contractor. However, for the first time, TAG has observed COLDRIVER campaigns targeting the military of multiple Eastern European countries, as well as a NATO Centre of Excellence. https://blog.google/threat-analysis-group/tracking-cyber-activity-eastern-europe/

2022-04 COLDRIVER, a Russian-based threat actor sometimes referred to as Callisto, continues to use Gmail accounts to send credential phishing emails to a variety of Google and non-Google accounts. https://blog.google/threat-analysis-group/update-on-cyber-activity-in-eastern-europe/

2022-07 Exposing TAG- 53’s Credential Harvesting Infrastructure Used for Russia-Aligned Espionage Operations https://go.recordedfuture.com/hubfs/reports/cta-2022-1205.pdf

2022-08 Russian hackers targeted U.S. nuclear scientists https://www.reuters.com/world/europe/russian-hackers-targeted-us-nuclear-scientists-2023-01-06/

2022-11 Russian threat group COLDRIVER expands its targeting of Western officials to include the use of malware https://blog.google/threat-analysis-group/google-tag-coldriver-russian-phishing-malware/

2023-03 BlueCharlie, Previously Tracked as TAG 53, Continues to Deploy New Infrastructure in 2023 https://go.recordedfuture.com/hubfs/reports/cta-2023-0802.pdf

2024-09 Russian pro-democracy nonprofit investigates alleged data breach by Kremlin-backed hackers https://therecord.media/free-russia-foundation-data-breach

2024-11 New Star Blizzard spear-phishing campaign targets WhatsApp accounts https://www.microsoft.com/en-us/security/blog/2025/01/16/new-star-blizzard-spear-phishing-campaign-targets-whatsapp-accounts/

2025-01 COLDRIVER Using New Malware To Steal Documents From Western Targets and NGOs https://cloud.google.com/blog/topics/threat-intelligence/coldriver-steal-documents-western-targets-ngos

Reports & References 2

https://www.lastline.com/labsblog/threat-actor-cold-river-network-traffic-analysis-and-a-deep-dive-on-agent-drable/ https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-341a

ETDA Profile

Cold River

Origin

Russia

First Seen 2019

Sponsor State-sponsored, FSB Centre 18: Centre for Information Security (TsIB)

Motivation

Information theft and espionage

View on ETDA APT Groups ↗