Microsoft Announces Disruption of Russian Espionage APT

guest · Aug 15, 2022

August 15, 2022

The threat actor, identified by Microsoft as SEABORGIUM, has been documented since at least 2017 actively conducting cyberespionage attacks against military personnel, government officials, think tanks, and journalists in Europe and the South Caucasus.

Redmond’s security research and threat hunting teams partnered with abuse teams in Microsoft to disable OneDrive and other Microsoft-linked accounts and beef up its Defender SmartScreen technology to block phishing domains.
Click to expand...

In a note announcing the disruption, Microsoft also exposed the Russian threat actor’s malware infrastructure and released IoCs (indicators of compromise) to help defenders hunt for signs of infections.

Based on IOCs and actor tactics, Microsoft confirmed SEABORGIUM overlaps with previously published documentation from Google (codename COLDRIVER) and F-Secure (codename Callisto Group) and warned that the APT group’s objectives and victimology align closely with Russian state interests.
Click to expand...

From Microsoft’s documentation:

Based on some of the impersonation and targeting observed, we suspect that the threat actor uses social media platforms, personal directories, and general open-source intelligence (OSINT) to supplement their reconnaissance efforts.

MSTIC, in partnership with LinkedIn, has observed fraudulent profiles attributed to SEABORGIUM being used sporadically for conducting reconnaissance of employees from specific organizations of interest. In accordance with their policies, LinkedIn terminated any account identified as conducting inauthentic or fraudulent behavior.
In addition to reconnaissance on LinkedIn, Microsoft caught the threat actor registering email accounts at consumer email providers for the specific purpose of impersonating individuals for add-on phishing lures.
Click to expand...

The SEABORGIUM actor has been observed embedding malicious links and PDF files into the body of phishing emails and using OneDrive to host booby-trapped documents.

The group has also been caught using stolen credentials to directly sign-in to victim email accounts and stealing emails and attachments from compromised inboxes.
Click to expand...

Microsoft: Disrupting SEABORGIUM’s ongoing phishing operations

The Microsoft Threat Intelligence Center (MSTIC) has observed and taken actions to disrupt campaigns launched by SEABORGIUM, an actor Microsoft has tracked since 2017. SEABORGIUM is a threat actor that originates from Russia, with objectives and victimology that align closely with Russian state interests. Its campaigns involve persistent phishing and credential theft campaigns leading to intrusions and data theft.

SEABORGIUM is a highly persistent threat actor, frequently targeting the same organizations over long periods of time. Once successful, it slowly infiltrates targeted organizations’ social networks through constant impersonation, rapport building, and phishing to deepen their intrusion.
Click to expand...

Since the beginning of 2022, Microsoft has observed SEABORGIUM campaigns targeting over 30 organizations, in addition to personal accounts of people of interest. SEABORGIUM primarily targets NATO countries, particularly the US and the UK, with occasional targeting of other countries in the Baltics, the Nordics, and Eastern Europe.
Click to expand...

Log in or Sign up

Microsoft Announces Disruption of Russian Espionage APT

guest Guest

Log in or Sign up

Microsoft Announces Disruption of Russian Espionage APT

guest Guest

Useful Searches