British Cyber Agency Warns of Russian and Iranian Hackers Targeting Key Industries

Jan 27, 2023Ravie LakshmananNation-State-Sponsored Attacks

The U.K. National Cyber Security Centre (NCSC) on Thursday
warned of spear-phishing attacks mounted by Russian and Iranian
state-sponsored actors for information-gathering operations.

“The attacks are not aimed at the general public but targets in
specified sectors, including academia, defense, government
organizations, NGOs, think tanks, as well as politicians,
journalists and activists,” the NCSC said^[1].

The agency attributed the intrusions to SEABORGIUM^[2]
(aka Callisto, COLDRIVER, and TA446) and APT42^[3]
(aka ITG18, TA453, and Yellow Garuda). The similarities in the
modus operandi aside, there is no evidence the two groups are
collaborating with each other.

The activity is typical of spear-phishing campaigns, where the
threat actors send messages tailored to the targets, while also
taking enough time to research their interests and identify their
social and professional circles.

The initial contact is designed to appear innocuous in an
attempt to gain their trust and can go on for weeks before
proceeding to the exploitation phase. This takes the form of
malicious links that can lead to credential theft and onward
compromise, including data exfiltration.

To maintain the ruse, the adversarial crews are said to have
created bogus profiles on social media platforms to impersonate
field experts and journalists to trick victims into opening the
links.

The Russian state-sponsored SEABORGIUM group has a history^[4]
of establishing fake login pages^[5] mimicking legitimate
defense companies and nuclear research labs to pull off its
credential harvesting attacks.

APT42, which operates as the espionage arm of Iran’s Islamic
Revolutionary Guard Corps (IRGC), is said to share overlaps with
PHOSPHORUS and is part of a larger group tracked as Charming
Kitten.

The threat actor, like SEABORGIUM, is known to masquerade as
journalists^[6], research institutes, and think
tanks^[7] to engage with its
targets using an ever-changing arsenal of tools and tactics to
accommodate IRGC’s evolving priorities.

Enterprise security firm Proofpoint, in December 2022, disclosed^[8]
the group’s “use of compromised accounts, malware, and
confrontational lures to go after targets with a range of
backgrounds from medical researchers to realtors to travel
agencies,” calling it a deviation from the “expected phishing
activity.”

The stolen credentials are then used to log in to targets’ email
accounts and access sensitive information, in addition to setting
up mail-forwarding rules to maintain continued visibility into
victim correspondence.

Furthermore, a notable aspect of these campaigns is the use of
targets’ personal email addresses, likely as a means to circumvent
security controls put in place on corporate networks.

“These campaigns by threat actors based in Russia and Iran
continue to ruthlessly pursue their targets in an attempt to steal
online credentials and compromise potentially sensitive systems,”
Paul Chichester, NCSC director of operations, said.