ETDA สำนักงานพัฒนาธุรกรรมทางอิเล็กทรอนิกส์
Electronic Transactions Development Agency
Report
Search
Home > List all groups > Cold River

Threat Group Cards: A Threat Actor Encyclopedia

Permanent link APT group: Cold River

NamesCold River (Lastline)
Nahr el bared (original place)
Nahr Elbard (transliteration)
Cobalt Edgewater (SecureWorks)
Calisto (?)
CountryRussia Russia
MotivationInformation theft and espionage
First seen2019
Description(Lastline) While reviewing some network anomalies, we recently uncovered Cold River, a sophisticated threat actor making malicious use of DNS tunneling for command and control activities. We have been able to decode the raw traffic in command and control, find sophisticated lure documents used in the campaign, connect other previously unknown samples, and associate a number of legitimate organizations whose infrastructure is referenced and used in the campaign.

The campaign targets Middle Eastern organizations largely from the Lebanon and United Arab Emirates, though, Indian and Canadian companies with interests in those Middle Eastern countries are also targeted. There are new TTPs used in this attack – for example Agent_Drable is leveraging the Django python framework for command and control infrastructure, the technical details of which are outlined later in the blog.
ObservedSectors: Defense, NGOs, Think Tanks.
Countries: Canada, India, Lebanon, UAE, Ukraine, USA, NATO.
Tools usedDNSpionage.
Operations performedMar 2022COLDRIVER, a Russian-based threat actor sometimes referred to as Calisto, has launched credential phishing campaigns, targeting several US based NGOs and think tanks, the military of a Balkans country, and a Ukraine based defense contractor. However, for the first time, TAG has observed COLDRIVER campaigns targeting the military of multiple Eastern European countries, as well as a NATO Centre of Excellence.
<https://blog.google/threat-analysis-group/tracking-cyber-activity-eastern-europe/>
Apr 2022COLDRIVER, a Russian-based threat actor sometimes referred to as Callisto, continues to use Gmail accounts to send credential phishing emails to a variety of Google and non-Google accounts.
<https://blog.google/threat-analysis-group/update-on-cyber-activity-in-eastern-europe/>
Information<https://www.lastline.com/labsblog/threat-actor-cold-river-network-traffic-analysis-and-a-deep-dive-on-agent-drable/>

Last change to this card: 04 May 2022

Download this actor card in PDF or JSON format

Digital Service Security Center
Electronic Transactions Development Agency

Follow us on

Facebook Twitter

Report incidents

Telephone +66 (0)2-123-1227
E-mail [email protected]