Cold River, a Russian-linked advanced persistent threat (APT) group also tracked as Star Blizzard and Callisto, has been active since at least 2015, primarily focusing on cyber espionage and intelligence collection aligned with Russian state interests. The group is attributed to Russia's Federal Security Service (FSB) Centre 18. Initially relying on credential phishing, Cold River has shown a notable evolution in its tactics, quickly retooling and deploying new custom malware strains, such as SPICA, NOROBOT, YESROBOT, and MAYBEROBOT, often within days of previous tool exposure. This rapid adaptation and re-tooling, coupled with highly personalized social engineering techniques and occasional operational security failures that allow researchers to track their infrastructure, distinguish Cold River from other state-sponsored groups, despite consistent alignment with Kremlin objectives and a focus on geopolitical targets.

Aliases del actor

Nahr ElbardNahr el bared

Actores similares

coldriveractor · 1winnti--network-driver-coactor · 1apt-coldwastrelactor · 1Device Driver Discoveryactor · 1COLDWASTRELapt · 0GOLD RIVERVIEWapt · 0