Cold River

Cold River, also known as Star Blizzard, Callisto, and UNC4057, is a sophisticated threat actor linked to the Kremlin. The group has been associated with numerous cyber espionage activities that align with Russian interests. Chief analyst at cybersecurity specialist Mandiant, John Hultquist, has attributed Cold River to Center 18 of the FSB, one of Russia's security services sponsoring global cyber espionage. The group has reportedly been delivering PDF documents containing malware to its targets since November 2022. In January of this year, Reuters reported that Cold River targeted three US nuclear research laboratories. The group initially used phishing emails to steal login credentials from its targets but has evolved its tactics over time. Google's Threat Analysis Group (TAG) observed that Cold River has been increasing its activity in recent months and using new tactics capable of causing more disruption. These tactics include the use of a custom backdoor tracked as "SPICA," which represents the first custom malware developed and used by Cold River. If a target indicates they cannot read a document sent by the hackers, a link to a "decryption" utility is provided, which is actually the SPICA backdoor. After discovering the Cold River malware campaign, Google added all identified websites, domains, and files to its Safe Browsing service. Despite law enforcement action, Cold River activity has remained fairly consistent over the past several years. The malware SPICA is believed to be under active development and used in ongoing attacks. This evolution of tactics beyond phishing and the development of custom malware indicate an escalation in the threat posed by Cold River.