news.mlab.sh
Threat intelligence
Threat actor

Cold River

Profile from actors.mlab.sh, coverage from our own index.

Suspected origin
Russia
First seen
2019-01-01 00:00:00
Motivation
Information theft and espionage
Targeted sectors
Defense, NGOs, Think Tanks
TLP
WHITE

(Lastline) While reviewing some network anomalies, we recently uncovered Cold River, a sophisticated threat actor making malicious use of DNS tunneling for command and control activities. We have been able to decode the raw traffic in command and control, find sophisticated lure documents used in the campaign, connect other previously unknown samples, and associate a number of legitimate organizations whose infrastructure is referenced and used in the campaign. The campaign targets Middle Eastern organizations largely from the Lebanon and United Arab Emirates, though, Indian and Canadian companies with interests in those Middle Eastern countries are also targeted. There are new TTPs used in this attack – for example Agent_Drable is leveraging the Django python framework for command and control infrastructure, the technical details of which are outlined later in the blog.

Also known as

Blue CallistoBlueCharlieCalistoCallisto GroupCobalt EdgewaterCOLDRIVERGossamer BearGrey ProIRON FRONTIERMythic UrsaNahr el baredNahr ElbardSeaborgiumStar BlizzardTA446TAG-53UNC4057

Tooling and malware

Spica

MITRE ATT&CK techniques

T1539 Steal Web Session CookieT1589 Gather Victim Identity InformationT1593 Search Open Websites/DomainsT1583 Acquire InfrastructureT1078 Valid Accounts

Coverage 3

All articles