A state-sponsored hacking group with links to Russia has been linked to attack infrastructure that spoofs the Microsoft login page of Global Ordnance, a legitimate U.S.-based military weapons and hardware supplier.
Recorded Future attributed the new infrastructure to a threat activity group it tracks under the name TAG-53, and is broadly known by the cybersecurity community as Callisto, COLDRIVER, SEABORGIUM, and TA446.
“Based on historical public reporting on overlapping TAG-53 campaigns, it is likely that this credential harvesting activity is enabled in part through phishing,” Recorded Future’s Insikt Group said in a report published this week.
The cybersecurity firm said it discovered 38 domains, nine of which contained references to companies like UMO Poland, Sangrail LTD, DTGruelle, Blue Sky Network, the Commission for International Justice and Accountability (CIJA), and the Russian Ministry of Internal Affairs.
It’s suspected that the themed domains are likely an attempt on part of the adversary to masquerade as authentic parties in social engineering campaigns.
“Notably, a consistent trend has emerged regarding the use of specifically tailored infrastructure by TAG-53 highlighting the long-term use of similar techniques for their strategic campaigns,” the researchers said.
The development comes nearly four months after Microsoft disclosed that it took steps to disrupt phishing and credential theft attacks mounted by the group with the goal of breaching defense and intelligence consulting companies as well as NGOs, think tanks, and higher education entities in the U.K. and the U.S.
Enterprise security company Proofpoint has further called out the group for its sophisticated impersonation tactics to deliver rogue phishing links.
| Terms used in TAG-53 linked domains |
Additionally, the threat actor has been attributed with low confidence to a spear-phishing operation targeting Ukraine’s Ministry of Defence coinciding with the onset of Russia’s military invasion of the country earlier this March.
SEKOIA.IO, in a separate write-up, corroborated the findings, uncovering a total of 87 domains, with two of them alluding to private sector companies Emcompass and BotGuard. Also targeted were four NGOs involved in Ukraine crisis relief.
One of those attacks involved email communications between the NGO and the attacker using a spoofed email address mimicking a trusted source, followed by sending a malicious PDF containing a phishing link in an attempt to evade detection from email gateways.
“The email exchange shows that the attacker did not include the malicious payload in the ?rst email, but waited to get an answer to build a relationship and avoid suspicion before sending the payload to the victim,” the cybersecurity company explained.
The use of typosquatted Russian ministry domains further adds weight to Microsoft’s assessment that SEABORGIUM targets former intelligence officials, experts in Russian affairs, and Russian citizens abroad.
SEKOIA.IO also characterized the targeting of CIJA as an intelligence gathering mission designed to amass “war crime-related evidence and/or international justice procedures, likely to anticipate and build counter narrative on future accusations.”
The disclosures arrive as threat intelligence firm Lupovis revealed that Russian threat actors have compromised the networks belonging to several companies in the U.K., the U.S., France, Brazil, South Africa, and are “rerouting through their networks” to launch attacks against Ukraine.
Microsoft, in the meanwhile, has warned of “potential Russian attack in the digital domain over the course of this winter,” pointing out Moscow’s “multi-pronged hybrid technology approach” of conducting cyber strikes against civilian infrastructure and influence operations seeking to fuel discord in Europe.