COLDRIVER

Coldriver, also known as Star Blizzard, Callisto, and Seaborgium, is a Russia-based cyber-espionage group believed to be backed by the Federal Security Service (FSB). This threat actor has been active since at least 2015, targeting government officials, military personnel, journalists, think tanks, and non-profit organizations such as the Free Russia Foundation. Their activities have focused on undermining democratic processes in Western nations, including the US and UK, with investigations linking them to various data breaches and cyber-espionage campaigns. Google's Threat Analysis Group (TAG) has warned that Coldriver uses a custom backdoor for their operations, highlighting the sophistication of their attacks. The group has also been linked to the River of Phish campaign, with attribution confirmed through investigations by Citizen Lab, Microsoft Security Threat Intelligence Center (MSTIC), Proofpoint, and PwC among others. Additionally, it has been observed that other cyber-espionage groups distinct from Coldriver have participated in these campaigns, indicating a complex and multifaceted threat landscape. In response to the threats posed by Coldriver, both Google and Microsoft have taken actions to mitigate their impact. Microsoft filed a civil action to seize 66 internet domains used by the group, while the Justice Department unsealed a warrant to seize 41 domains linked to the group for computer fraud in the United States. These measures underscore the seriousness of the threat posed by Coldriver and the ongoing efforts by cybersecurity entities to counteract their malicious activities.