🇷🇺

Cold River

APT Group Information theft and espionage ETDA ✓

Also Known As 2 names

Nahr Elbard Nahr el bared

Target Countries 7

Countries highlighted in red

Canada United Kingdom India Lebanon Sweden Ukraine United States

Sectors Targeted

Computer Systems Design and Related Services 54151 Think Tanks Periodical Publishers 51112 Electric Power Generation 22111 Employment Placement Agencies and Executive Search Services 56131 NGOs Research and Development in the Social Sciences and Humanities 54172 Defense Colleges, Universities, and Professional Schools 6113

Details

Origin 🇷🇺 RU

Last Updated 01 Jun 2022

MITRE ATT&CK 62

T1005 - Data from Local System T1012 - Query Registry T1016 - System Network Configuration Discovery T1027 - Obfuscated Files or Information T1027.002 - Software Packing T1033 - System Owner/User Discovery T1036 - Masquerading T1041 - Exfiltration Over C2 Channel T1053.005 - Scheduled Task T1056.001 - Keylogging T1056.003 - Web Portal Capture T1057 - Process Discovery T1059 T1059.001 - PowerShell T1059.003 - Windows Command Shell T1059.006 - Python T1059.007 - JavaScript T1071 - Application Layer Protocol T1071.001 - Web Protocols T1074 - Data Staged T1078 T1082 - System Information Discovery T1083 - File and Directory Discovery T1102 - Web Service T1105 - Ingress Tool Transfer T1112 - Modify Registry T1114 T1114.002 T1114.003 T1115 - Clipboard Data T1120 - Peripheral Device Discovery T1124 - System Time Discovery T1132.001 - Standard Encoding T1140 - Deobfuscate/Decode Files or Information T1204 - User Execution T1204.001 - Malicious Link T1204.002 - Malicious File T1217 - Browser Bookmark Discovery T1539 T1547.001 - Registry Run Keys / Startup Folder T1550 T1550.004 T1566 - Phishing T1566.001 - Spearphishing Attachment T1571 - Non-Standard Port T1583 T1583.001 - Domains T1585 T1585.001 T1585.002 T1586 T1586.002 T1588 T1588.002 T1589 T1593 T1598 T1598.002 T1598.003 T1608 T1608.001 T1614 - System Location Discovery

Related Zero-Days

No zero-day CVE linked to this actor

Known Names 16 entries

Cold River Lastline

Nahr el bared original place

Nahr Elbard transliteration

Cobalt Edgewater SecureWorks

TA446 Proofpoint

Seaborgium Microsoft

TAG-53 Recorded Future

BlueCharlie Recorded Future

Blue Callisto PWC

Calisto Sekoia

Star Blizzard Microsoft

UNC4057 Mandiant

IRON FRONTIER SecureWorks

Grey Pro ?

Mythic Ursa Palo Alto

Gossamer Bear CrowdStrike

Observed Target Countries 7

Based on ETDA data — countries highlighted in red

Canada India Lebanon UAE Ukraine USA NATO

Description

(Lastline) While reviewing some network anomalies, we recently uncovered Cold River, a sophisticated threat actor making malicious use of DNS tunneling for command and control activities. We have been able to decode the raw traffic in command and control, find sophisticated lure documents used in the campaign, connect other previously unknown samples, and associate a number of legitimate organizations whose infrastructure is referenced and used in the campaign. The campaign targets Middle Eastern organizations largely from the Lebanon and United Arab Emirates, though, Indian and Canadian companies with interests in those Middle Eastern countries are also targeted. There are new TTPs used in this attack – for example Agent_Drable is leveraging the Django python framework for command and control infrastructure, the technical details of which are outlined later in the blog.

Tools Used 3

DNSpionage LOSTKEYS SPICA

Operations 10

2022-02 Blue Callisto orbits around US Laboratories in 2022 https://www.pwc.com/gx/en/issues/cybersecurity/cyber-threat-intelligence/blue-callisto-orbits-around-us.html

2022-03 COLDRIVER, a Russian-based threat actor sometimes referred to as Calisto, has launched credential phishing campaigns, targeting several US based NGOs and think tanks, the military of a Balkans country, and a Ukraine based defense contractor. However, for the first time, TAG has observed COLDRIVER campaigns targeting the military of multiple Eastern European countries, as well as a NATO Centre of Excellence. https://blog.google/threat-analysis-group/tracking-cyber-activity-eastern-europe/

2022-04 COLDRIVER, a Russian-based threat actor sometimes referred to as Callisto, continues to use Gmail accounts to send credential phishing emails to a variety of Google and non-Google accounts. https://blog.google/threat-analysis-group/update-on-cyber-activity-in-eastern-europe/

2022-07 Exposing TAG- 53’s Credential Harvesting Infrastructure Used for Russia-Aligned Espionage Operations https://go.recordedfuture.com/hubfs/reports/cta-2022-1205.pdf

2022-08 Russian hackers targeted U.S. nuclear scientists https://www.reuters.com/world/europe/russian-hackers-targeted-us-nuclear-scientists-2023-01-06/

2022-11 Russian threat group COLDRIVER expands its targeting of Western officials to include the use of malware https://blog.google/threat-analysis-group/google-tag-coldriver-russian-phishing-malware/

2023-03 BlueCharlie, Previously Tracked as TAG 53, Continues to Deploy New Infrastructure in 2023 https://go.recordedfuture.com/hubfs/reports/cta-2023-0802.pdf

2024-09 Russian pro-democracy nonprofit investigates alleged data breach by Kremlin-backed hackers https://therecord.media/free-russia-foundation-data-breach

2024-11 New Star Blizzard spear-phishing campaign targets WhatsApp accounts https://www.microsoft.com/en-us/security/blog/2025/01/16/new-star-blizzard-spear-phishing-campaign-targets-whatsapp-accounts/

2025-01 COLDRIVER Using New Malware To Steal Documents From Western Targets and NGOs https://cloud.google.com/blog/topics/threat-intelligence/coldriver-steal-documents-western-targets-ngos

Reports & References 2

https://www.lastline.com/labsblog/threat-actor-cold-river-network-traffic-analysis-and-a-deep-dive-on-agent-drable/ https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-341a

ETDA Profile

Cold River

Origin

Russia

First Seen 2019

Sponsor State-sponsored, FSB Centre 18: Centre for Information Security (TsIB)

Motivation

Information theft and espionage

View on ETDA APT Groups ↗