ColdRiver APT

The ColdRiver APT (aka “Seaborgium“, “Callisto”, “Star Blizzard”, “TA446”) is a Russian cyberespionage outfit that has been targeting government officials, military personnel, journalists and think tanks since at least 2015.

The threat actor has previously engaged in ongoing phishing and credential theft efforts that resulted in intrusions and data theft. Although specialists have noticed efforts targeting the Baltics, Nordics, and Eastern Europe regions, including Ukraine, the APT predominantly targets NATO member states.

Google TAG researchers have warned against COLDRIVER, claiming that it is enhancing its tactics techniques and procedures (TTPs), in order to evade detection. 

TAG has recently seen COLDRIVER use phishing efforts to spread bespoke malware using PDFs as lure materials. Google experts discovered and stopped these attempts by adding all known domains and hashes to Safe Browsing blocklists.

In November 2022, TAG observed that COLDRIVER was sending its targets malicious PDF documents from their fraudulent accounts. Threat actors asked for the recipient's feedback on fresh opinion pieces or other kinds of publications that they were hoping to publish using the lure materials. The victims see an encrypted text when they view the PDF.

In case the targets fail to read the content, following which they contact the threat actors, they receive a link from the cyberspies to a decryption tool located on the threat actors' website. After downloading and running the tool, a backdoor—tracking as SPICA—is installed and a bogus document appears. 

“Once executed, SPICA decodes an embedded PDF, writes it to disk, and opens it as a decoy for the user. In the background, it establishes persistence and starts the main C2 loop, waiting for commands to execute,” reads TAG’s analysis. 

Spica is a Rust backdoor that uses JSON over websockets for C2. Spica supports multiple capabilities, such as: 

• Executing arbitrary shell commands. 
• Stealing cookies from Chrome, Firefox, Opera and Edge. 
• Uploading and downloading files. 
• Perusing the filesystem by listing the contents of it. 
• Enumerating documents and exfiltrating them in an archive 
• There is also a command called “telegram,” however the functionality of this command is unclear.

An obfuscated PowerShell command that generates a scheduled activity called CalendarChecker is how the infection stays persistent.

The Russian APT has reportedly been using SPICA since at least November 2022, while the researchers have only observed its use since early September 2023.