KazPost

Kazakhstan News
Thursday, Mar 28, 2024

Russian hacking team ‘Cold River’ targeted US nuclear scientists

Russian hacking team ‘Cold River’ targeted US nuclear scientists

A Russian hacking team known as “Cold River” targeted three nuclear research laboratories in the United States this past summer, according to internet records reviewed by Reuters and five cybersecurity experts.

Between August and September, as President Vladimir Putin indicated Russia would be willing to use nuclear weapons to defend its territory, Cold River targeted the Brookhaven (BNL), Argonne (ANL) and Lawrence Livermore National Laboratories (LLNL), according to internet records that showed the hackers creating fake login pages for each institution and emailing nuclear scientists in a bid to make them reveal their passwords.

Reuters was unable to determine why the labs were targeted or if any attempted intrusion was successful. A BNL spokesperson declined to comment. LLNL did not respond to a request for comment. An ANL spokesperson referred questions to the US Department of Energy, which declined to comment.

Cold River has escalated its hacking campaign against Kyiv’s allies since the invasion of Ukraine, according to cybersecurity researchers and western government officials. The digital blitz against the US labs occurred as UN experts entered Russian-controlled Ukrainian territory to inspect Europe’s biggest atomic power plant and assess the risk of what both sides said could be a devastating radiation disaster amid heavy shelling nearby.

Cold River, which first appeared on the radar of intelligence professionals after targeting Britain’s foreign office in 2016, has been involved in dozens of other high-profile hacking incidents in recent years, according to interviews with nine cybersecurity firms.

Reuters traced email accounts used in its hacking operations between 2015 and 2020 to an IT worker in the Russian city of Syktyvkar.

“This is one of the most important hacking groups you’ve never heard of,” said Adam Meyer, senior vice president of intelligence at US cybersecurity firm CrowdStrike. “They are involved in directly supporting Kremlin information operations.”

Russia’s Federal Security Service (FSB), the domestic security agency that also conducts espionage campaigns for Moscow, and Russia’s embassy in Washington did not respond to emailed requests for comment.

Western officials say the Russian government is a global leader in hacking and uses cyber-espionage to spy on foreign governments and industries to seek a competitive advantage. However, Moscow has consistently denied that it carries out hacking operations.

Reuters showed its findings to five industry experts who confirmed the involvement of Cold River in the attempted nuclear labs hacks, based on shared digital fingerprints that researchers have historically tied to the group.

The US National Security Agency (NSA) declined to comment on Cold River’s activities. Britain’s Global Communications Headquarters (GCHQ), its NSA equivalent, did not comment. The foreign office declined to comment.


‘Intelligence collection’


In May, Cold River broke into and leaked emails belonging to the former head of Britain’s MI6 spy service. That was just one of several ‘hack and leak’ operations last year by Russia-linked hackers in which confidential communications were made public in Britain, Poland and Latvia, according to cybersecurity experts and Eastern European security officials.

In another recent espionage operation targeting critics of Moscow, Cold River registered domain names designed to imitate at least three European NGOs investigating war crimes, according to French cybersecurity firm SEKOIA.IO.

The NGO-related hacking attempts occurred just before and after the October 18 launch of a report by a UN independent commission of enquiry that found Russian forces were responsible for the “vast majority” of human rights violations in the early weeks of the Ukraine war, which Russia has called a “special military operation.”

In a blog post, SEKOIA.IO said that, based on its targeting of the NGOs, Cold River was seeking to contribute to “Russian intelligence collection about identified war crime-related evidence and/or international justice procedures.” Reuters was unable independently to confirm why Cold River targeted the NGOs.

The Commission for International Justice and Accountability (CIJA), a nonprofit founded by a veteran war crimes investigator, said it had been repeatedly targeted by Russian-backed hackers in the past eight years without success. The other two NGOs, the International Center of Nonviolent Conflict and the Center for Humanitarian Dialogue, did not respond to requests for comment.

Russia’s embassy in Washington did not return a request seeking comment about the attempted hack against CIJA.

Cold River has employed tactics such as tricking people into entering their usernames and passwords on fake websites to gain access to their computer systems, security researchers told Reuters. To do this, Cold River has used a variety of email accounts to register domain names such as “goo-link online” and “online365-office com” which at a glance look similar to legitimate services operated by firms like Google and Microsoft, the security researchers said.


Deep ties to Russia


Cold River made several missteps in recent years that allowed cybersecurity analysts to pinpoint the exact location and identity of one of its members, providing the clearest indication yet of the group’s Russian origin, according to experts from Internet giant Google, British defense contractor BAE, and US intelligence firm Nisos.

Multiple personal email addresses used to set up Cold River missions belong to Andrey Korinets, a 35-year-old IT worker and bodybuilder in Syktyvkar, about 1,600 kilometers (1,000 miles) northeast of Moscow. Usage of these accounts left a trail of digital evidence from different hacks back to Korinets’ online life, including social media accounts and personal websites.

Billy Leonard, a Security Engineer on Google’s Threat Analysis Group who investigates nation state hacking, said Korinets was involved. “Google has tied this individual to the Russian hacking group Cold River and their early operations,” he said.

Vincas Ciziunas, a security researcher at Nisos who also connected Korinets’ email addresses to Cold River activity, said the IT worker appeared to be a “central figure” in the Syktyvkar hacking community, historically. Ciziunas discovered a series of Russian language internet forums, including an eZine, where Korinets had discussed hacking, and shared those posts with Reuters.

Korinets confirmed that he owned the relevant email accounts in an interview with Reuters but he denied any knowledge of Cold River. He said his only experience with hacking came years ago when he was fined by a Russian court over a computer crime committed during a business dispute with a former customer.

Reuters was able separately to confirm Korinets’ links to Cold River by using data compiled through cybersecurity research platforms Constella Intelligence and DomainTools, which help identify the owners of websites: the data showed that Korinets’ email addresses registered numerous websites used in Cold River hacking campaigns between 2015 and 2020.

It is unclear whether Korinets has been involved in hacking operations since 2020. He offered no explanation of why these email addresses were used and did not respond to further phone calls and emailed questions.

Newsletter

Related Articles

KazPost
0:00
0:00
Close
It's always the people with the dirty hands pointing their fingers
Paper straws found to contain long-lasting and potentially toxic chemicals - study
FTX's Bankman-Fried headed for jail after judge revokes bail
Blackrock gets half a trillion dollar deal to rebuild Ukraine
America's First New Nuclear Reactor in Nearly Seven Years Begins Operations
Southeast Asia moves closer to economic unity with new regional payments system
Today Hunter Biden’s best friend and business associate, Devon Archer, testified that Joe Biden met in Georgetown with Russian Moscow Mayor's Wife Yelena Baturina who later paid Hunter Biden $3.5 million in so called “consulting fees”
Singapore Carries Out First Execution of a Woman in Two Decades Amid Capital Punishment Debate
Google testing journalism AI. We are doing it already 2 years, and without Google biased propoganda and manipulated censorship
Unlike illegal imigrants coming by boats - US Citizens Will Need Visa To Travel To Europe in 2024
Musk announces Twitter name and logo change to X.com
The future of sports
Unveiling the Black Hole: The Mysterious Fate of EU's Aid to Ukraine
Farewell to a Music Titan: Tony Bennett, Renowned Jazz and Pop Vocalist, Passes Away at 96
Alarming Behavior Among Florida's Sharks Raises Concerns Over Possible Cocaine Exposure
Transgender Exclusion in Miss Italy Stirs Controversy Amidst Changing Global Beauty Pageant Landscape
TikTok Takes On Spotify And Apple, Launches Own Music Service
Global Trend: Using Anti-Fake News Laws as Censorship Tools - A Deep Dive into Tunisia's Scenario
Arresting Putin During South African Visit Would Equate to War Declaration, Asserts President Ramaphosa
Hacktivist Collective Anonymous Launches 'Project Disclosure' to Unearth Information on UFOs and ETIs
Typo sends millions of US military emails to Russian ally Mali
Server Arrested For Theft After Refusing To Pay A Table's $100 Restaurant Bill When They Dined & Dashed
The Changing Face of Europe: How Mass Migration is Reshaping the Political Landscape
China Urges EU to Clarify Strategic Partnership Amid Trade Tensions
Europe is boiling: Extreme Weather Conditions Prevail Across the Continent
The Last Pour: Anchor Brewing, America's Pioneer Craft Brewer, Closes After 127 Years
Democracy not: EU's Digital Commissioner Considers Shutting Down Social Media Platforms Amid Social Unrest
Sarah Silverman and Renowned Authors Lodge Copyright Infringement Case Against OpenAI and Meta
Why Do Tech Executives Support Kennedy Jr.?
The New York Times Announces Closure of its Sports Section in Favor of The Athletic
BBC Anchor Huw Edwards Hospitalized Amid Child Sex Abuse Allegations, Family Confirms
Florida Attorney General requests Meta CEO's testimony on company's platforms' alleged facilitation of illicit activities
The Distorted Mirror of actual approval ratings: Examining the True Threat to Democracy Beyond the Persona of Putin
40,000 child slaves in Congo are forced to work in cobalt mines so we can drive electric cars.
Historic Moment: Edgars Rinkevics, EU's First Openly Gay Head of State, Takes Office as Latvia's President
An Ominous Shift in Warfare: Western Powers Risk War Crimes and Violate International Norms with Cluster Bomb Supply to Ukraine
Bye bye democracy, human rights, freedom: French Cops Can Now Secretly Activate Phone Cameras, Microphones And GPS To Spy On Citizens
The Poor Man With Money, Mark Zuckerberg, Unveils Twitter Replica with Heavy-Handed Censorship: A New Low in Innovation?
The Double-Edged Sword of AI: AI is linked to layoffs in industry that created it
US Sanctions on China's Chip Industry Backfire, Prompting Self-Inflicted Blowback
Meta Copy Twitter with New App, Threads
The New French Revolution
BlackRock Bitcoin ETF Application Refiled, Naming Coinbase as ‘Surveillance-Sharing’ Partner
Corruption in the European Parliament - Business as usual
UK Crypto and Stablecoin Regulations Become Law as Royal Assent is Granted
Paris Suburb Grapples with Violence as Curfew Imposed: Saint-Denis Residents Express Dismay and Anger
A Delaware city wants to let businesses vote in its elections
Alef Aeronautics Achieves Historic Milestone with Flight Certification for World's First Flying Car
Google Blocked Access to Canadian News in Response to New Legislation
French Politicians Advocate for Pan-European Regulation on Social Media Influencers
×