One Article Review
| Source |  Fortinet ThreatSignal |
|---|---|
| Identifiant | 6422259 |
| Date de publication | 2022-08-19 16:26:25 (vue: 2022-08-20 00:05:39) |
| Titre | SEABORGIUM APT Group Targets NATO Members and European Countries |
| Texte | FortiGuard Labs is aware of a report published by Microsoft of a threat actor named "SEABORGIUM", which the vendor attributed to Russia, that targeted organizations in NATO member countries as well as in Northern and Eastern Europe for espionage. Also referred as Callisto, TA446 and COLDRIVER, the threat actor has been active since 2015 and reportedly used a spyware developed by infamous HackingTeam in their earlier campaigns.Why is this Significant?This is significant because the "SEABORGIUM" threat actor has been active since 2015 and reportedly targeted various industries including defense contractors, think tanks, Non-Governmental Organizations (NGOs) and Intergovernmental Organizations (IGOs) in NATO member countries as well as other European countries for espionage.What is SEABORGIUM APT Group?SEABORGIUM is a threat actor that has reportedly targeted organizations that are associated with foreign and security policy making in Europe for at least seven years. Countries of interest include NATO partner nations as well as countries in Northern, Southern and Eastern Europe. The Microsoft blog indicates that the APT group targeted Ukraine's public sector prior to the ongoing Russo-Ukrainian war.The SEABORGIUM APT threat actor is also known as Callisto Group (Callisto), COLDRIVER, TA446, and is potentially related to Gamaredon Group.Infection tactics of SEABORGIUM include credential phishing attacks, sending a Word doc attachment with malware embedded or malicious macros, and sending emails with themes that the target is likely interested in; also establishing relationships on Social Networking Service (SNS), all presumably for email credential theft. The stolen credentials allow the threat actor to gain access to the victim's mailbox and exfiltrate information. The attacker also is believed to set up email rules in the victim's mailboxes that automatically forward incoming messages to the attacker's email address for data gathering.In earlier campaigns, the SEABORGIUM APT group is believed to have used the Scout implant from Galileo, one of the Remote Control Systems (RCS) developed by the infamous Italy based HackingTeam. The Scout agent sends victim's machine information and screen captures to the attacker's infrastructure.What is the Status of Coverage?FortiGuard Labs provides the following AV coverage for the samples believed to be related with the SEABORGIUM APT group:W32/Agent.AAAI!trW32/Agent.AACX!trW32/Trojan.I!trPDF/Agent.A9BA!trVBA/Agent.ADO!trAll network IOCs associated with this attack are blocked by the WebFiltering client. |
| Envoyé | Oui |
| Condensat | 2015 a9ba aaai aacx access active actor address ado agent all allow also apt are associated attachment attack attacker attacks attributed automatically aware based because been believed blocked blog callisto campaigns captures client coldriver contractors control countries coverage credential credentials data defense developed doc earlier eastern email emails embedded espionage establishing europe european exfiltrate following foreign fortiguard forward from gain galileo gamaredon gathering governmental group group:w32/agent hackingteam has have igos implant in; include including incoming indicates industries infamous infection information infrastructure interest interested intergovernmental iocs italy known labs least likely machine macros mailbox mailboxes making malicious malware member members messages microsoft named nations nato network networking ngos non northern one ongoing organizations other partner phishing policy potentially presumably prior provides public published rcs referred related relationships remote report reportedly rules russia russo samples scout screen seaborgium sector security sending sends service set seven significant since sns social southern spyware status stolen systems ta446 tactics tanks target targeted targets theft themes think threat trall trpdf/agent trvba/agent trw32/agent trw32/trojan ukraine ukrainian used various vendor victim war webfiltering well what which why word years |
| Tags | Threat Malware |
| Stories | |
| Notes | ★★★ |
| Move | 
|
L'article ne semble pas avoir été repris aprés sa publication.
L'article ne semble pas avoir été repris sur un précédent.