In
an advisory, the National Cyber Security Centre (NCSC), part of
Britain's GCHQ eavesdropping intelligence agency, said Cold
River researches its targets and impersonates people around them
using faked email addresses and social media profiles.
"There is often some correspondence between attacker and target,
sometimes over an extended period, as the attacker builds
rapport," the advisory said.
Russia's embassies in London and Washington did not immediately
respond to emailed requests for comment about the NCSC's
comments. The advisory did not directly attribute the digital
attacks to the Russian government.
Once a rapport has been built with a target, Cold River hackers
encourage the target to click on a malicious link which tricks
them into entering their login credentials on a website
controlled by the group, the advisory said.
The hackers use those stolen credentials to log into the
target's email accounts, "from where they are known to access
and steal emails and attachments from the victim's inbox," it
added.
Reuters reported that Cold River, also known as "Callisto" and "Seaborgium",
targeted three nuclear research laboratories in the United
States last summer and published private emails from former
British spymaster Richard Dearlove in May.
Russia's Foreign Ministry criticised the nuclear labs story,
calling it anti-Russian propaganda.
A second, Iran-based, group known as Charming Kitten has
deployed the same "spear-phishing" techniques to gather
information, according to the NCSC. Iran's mission to the United
Nations in New York said the Iranian government had no knowledge
of the group.
Since Russia's invasion of Ukraine, Cold River has escalated its
hacking campaign against Kyiv's allies, cybersecurity
researchers and western government officials told Reuters.
Western officials say the Russian government is a global leader
in hacking and uses cyber-espionage against foreign governments
and industries to seek a competitive advantage.
Moscow, however, has consistently denied that it carries out
hacking operations.
(Reporting by James Pearson; Editing by Chris Sanders and Daniel
Flynn)
[© 2023 Thomson Reuters. All rights
reserved.]
Copyright 2022 Reuters. All rights reserved. This material may
not be published, broadcast, rewritten or redistributed.
Thompson Reuters is solely responsible for this content.
![](column_spacer.png)
|
|