Russian Hackers Spotted Targeting U.S. Military Weapons and Hardware Supplier

Dec 07, 2022Ravie Lakshmanan

A state-sponsored hacking group with links to Russia has been
linked to attack infrastructure that spoofs the Microsoft login
page of Global Ordnance, a legitimate U.S.-based military weapons
and hardware supplier.

Recorded Future attributed the new infrastructure to a threat
activity group it tracks under the name TAG-53,
and is broadly known by the cybersecurity community as Callisto,
COLDRIVER, SEABORGIUM, and TA446.

“Based on historical public reporting on overlapping TAG-53
campaigns, it is likely that this credential harvesting activity is
enabled in part through phishing,” Recorded Future’s Insikt Group
said^[1]
in a report published this week.

The cybersecurity firm said it discovered 38 domains, nine of
which contained references to companies like UMO Poland, Sangrail
LTD, DTGruelle, Blue Sky Network, the Commission for International
Justice and Accountability (CIJA), and the Russian Ministry of
Internal Affairs.

It’s suspected that the themed domains are likely an attempt on
part of the adversary to masquerade as authentic parties in social
engineering campaigns.

“Notably, a consistent trend has emerged regarding the use of
specifically tailored infrastructure by TAG-53 highlighting the
long-term use of similar techniques for their strategic campaigns,”
the researchers said.

The development comes nearly four months after Microsoft
disclosed^[2]
that it took steps to disrupt phishing and credential theft attacks
mounted by the group with the goal of breaching defense and
intelligence consulting companies as well as NGOs, think tanks, and
higher education entities in the U.K. and the U.S.

Enterprise security company Proofpoint has further called out
the group for its sophisticated impersonation tactics to deliver
rogue phishing links.

Terms used in TAG-53 linked domains

Additionally, the threat actor has been attributed with low
confidence to a spear-phishing operation^[3] targeting Ukraine’s
Ministry of Defence^[4]
coinciding with the onset of Russia’s military invasion of the country^[5] earlier this March.

SEKOIA.IO, in a separate write-up^[6], corroborated the
findings, uncovering a total of 87 domains, with two of them
alluding to private sector companies Emcompass and BotGuard. Also
targeted were four NGOs involved in Ukraine crisis relief.

One of those attacks involved email communications between the
NGO and the attacker using a spoofed email address mimicking a
trusted source, followed by sending a malicious PDF containing a
phishing link in an attempt to evade detection from email
gateways.

“The email exchange shows that the attacker did not include the
malicious payload in the first email, but waited to get an answer to
build a relationship and avoid suspicion before sending the payload
to the victim,” the cybersecurity company explained.

The use of typosquatted Russian ministry domains further adds
weight to Microsoft’s assessment that SEABORGIUM targets former
intelligence officials, experts in Russian affairs, and Russian
citizens abroad.

SEKOIA.IO also characterized the targeting of CIJA as an
intelligence gathering mission designed to amass “war crime-related
evidence and/or international justice procedures, likely to
anticipate and build counter narrative on future accusations.”

The disclosures arrive as threat intelligence firm Lupovis
revealed^[7]
that Russian threat actors have compromised the networks belonging
to several companies in the U.K., the U.S., France, Brazil, South
Africa, and are “rerouting through their networks” to launch
attacks against Ukraine.

Microsoft, in the meanwhile, has warned^[8]
of “potential Russian attack in the digital domain over the course
of this winter,” pointing out Moscow’s “multi-pronged hybrid
technology approach” of conducting cyber strikes against civilian
infrastructure and influence operations seeking to fuel discord in
Europe.