COLDRIVER

Coldriver, also known as Star Blizzard, (Blue) Callisto, Blue Charlie, and Seaborgium, is a notorious Russia-based cyber-espionage group believed to be linked to the Federal Security Service's (FSB) Centre 18. The group has been actively involved in numerous malicious activities, including disinformation and credential-harvesting campaigns against Ukraine, as part of Russia's broader war efforts. This threat actor has been tracked by various cybersecurity organizations, including Microsoft, and has evolved its attack tactics over time, making it a significant concern for global cybersecurity. In a report published on August 14, 2024, the University of Toronto's investigative research group disclosed that Coldriver was responsible for the River of Phish campaign. This finding was corroborated by comparing investigation results with materials from the Microsoft Security Threat Intelligence Center (MSTIC), Proofpoint, PwC, and others. However, Citizen Lab researchers found that another cyber-espionage group distinct from Coldriver also participated in the campaign, indicating a complex and multi-faceted threat landscape. Google's Threat Analysis Group (TAG) has warned that Coldriver has been using a custom backdoor in its operations, further elevating the risk profile of this threat actor. In December, a joint cybersecurity advisory issued by the Cyber National Mission Force, the FBI, the Cybersecurity and Infrastructure Security Agency, and international cyber authorities highlighted advanced spear-phishing campaigns launched by Coldriver. These developments underscore the persistent and evolving nature of the threat posed by Coldriver and the need for robust cybersecurity measures to counter such sophisticated adversaries.