Microsoft Disrupts Seaborgium from Russia - TheCyberThrone

Microsoft has disrupted a prolific Russian state-backed highly persistent threat group called Seaborgium (aka Callisto Group, ColdRiver, TA446) known for conducting long-running cyber-espionage campaigns against mainly NATO countries.

Microsoft disabled the group accounts used for reconnaissance, phishing, and email collection, and updated detections against its phishing domains in Microsoft Defender SmartScreen.

Advertisements

Once successful, it slowly infiltrates targeted organizations’ social networks through constant impersonation, rapport building, and phishing to deepen their intrusion, Seaborgium has successfully compromised organizations and people of interest in consistent campaigns for several years, rarely changing methodologies or tactics.
Microsoft statement

Seaborgium, targeted over 30 organizations: mainly defense and intelligence consulting companies, NGOs and IGOs, think tanks, and higher education. The group also targets individuals such as former intelligence officials and Russian citizens living abroad, Microsoft said.

Once after the initial reconnaissance on its targets, it tries to establish rapport by contacting them on social media. Soon after, it will send a phishing email purporting to contain content of interest to the recipient.

Malicious URLs may be in the body of the email, a clickable button designed to open an attachment, or a OneDrive link which takes the user to a PDF file containing a URL. The ultimate goal is credential theft and then data exfiltration.

Advertisements

Regardless of the method of delivery, when the target clicks the URL, the target is directed to an actor-controlled server hosting a phishing framework. Microsoft has observed attempts by the actor to evade automated browsing and detonation by fingerprinting browsing behavior
Microsoft explained

Once the target is redirected to the final page, the framework prompts the target for authentication, mirroring the sign-in page for a legitimate provider and intercepting any credentials. After credentials are captured, the target is redirected to a website or document to complete the interaction.

Once Seaborgium has access to the victim’s email account, it will look to exfiltrate intelligence data and, on occasion, approach other people of interest via these compromised accounts to access sensitive info.

Remediation actions

Office 365 email filtering settings to be checked for ensuring a is in place for block spoofed emails, spam, and emails with malware.
Configure Office 365 to disable email auto-forwarding.
Use the included indicators of compromise to investigate whether they exist in your environment and assess for potential intrusion.
Require multifactor authentication (MFA) for all users as default, FIDO Tokens or Microsoft Authenticator
Avoid telephony-based MFA methods to avoid risks associated with SIM-jacking.

Advertisements

Indicators of Compromise

Related Stories

Tags: Cyber Espionage Microsoft Intelligence Phishing Attack Russian link Seaborgium Security

Leave a Reply Cancel reply

%d bloggers like this: