Google Alerts on Targeted Russian Espionage Campaign Against Europe and the United States

 

Google has just spotted a new Russian cyber espionage campaign. In a blog post published on January 18, 2024, the cyber experts at Google revealed some pretty typical methods used by Kremlin intelligence agents. Their targets include activists from non-governmental organizations (NGOs), former military members, and NATO officials. The hackers seem to be looking for information and activities related to Ukraine.

According to Google, the state-sponsored hacking group called "Cold River" is behind this campaign. These Russian agents are trying to deceive their victims using spear phishing methods. Essentially, they impersonate the identity of the target's friends, colleagues, or acquaintances, attempting to build trust before trapping the victim.

The French cybersecurity company Sekoia has disclosed the phishing domains used by these hackers. "Calisto" (another name for Cold River) is contributing to the efforts of Russian intelligence services to support Moscow's strategic interests, as stated by the company. "It appears that domain registration was one of the main skills of [Korinets], used by Russian secret services either directly or through a contractual relationship." The names and faces of many Kremlin hackers are no longer well-kept secrets.