Wednesday, June 19, 2024

SEABORGIUM APT Group Targets NATO Members and European Countries

A report published by Microsoft details of a threat actor named “SEABORGIUM”, which the vendor attributed to Russia, that targeted organizations in NATO member countries as well as in Northern and Eastern Europe for espionage. Also referred as Callisto, TA446 and COLDRIVER, the threat actor has been active since 2015 and reportedly used spyware developed by the infamous ‘HackingTeam’ in their earlier campaigns.

Why is this Significant?

This is significant because the “SEABORGIUM” threat actor has been active since 2015 and reportedly targeted various industries including defense contractors, think tanks, Non-Governmental Organizations (NGOs) and Intergovernmental Organizations (IGOs) in NATO member countries as well as other European countries for espionage.


SEABORGIUM is a threat actor that has reportedly targeted organizations that are associated with foreign and security policy making in Europe for at least seven years. Countries of interest include NATO partner nations as well as countries in Northern, Southern and Eastern Europe. The Microsoft blog indicates that the APT group targeted Ukraine’s public sector prior to the ongoing Russo-Ukrainian war.

The SEABORGIUM APT threat actor is also known as Callisto Group (Callisto), COLDRIVER, TA446, and is potentially related to Gamaredon Group.

Infection tactics of SEABORGIUM include credential phishing attacks, sending a Word doc attachment with malware embedded or malicious macros, and sending emails with themes that the target is likely interested in; also establishing relationships on Social Networking Service (SNS), all presumably for email credential theft. The stolen credentials allow the threat actor to gain access to the victim’s mailbox and exfiltrate information. The attacker also is believed to set up email rules in the victim’s mailboxes that automatically forward incoming messages to the attacker’s email address for data gathering.

Recommended:  Mitel 0-DAY used by hackers in a suspected ransomware attack

In earlier campaigns, the SEABORGIUM APT group is believed to have used the Scout implant from Galileo, one of the Remote Control Systems (RCS) developed by the infamous Italy-based HackingTeam. The Scout agent sends victim’s machine information and screen captures to the attacker’s infrastructure.


Disrupting SEABORGIUM’s ongoing phishing operations (Microsoft)

Update on cyber activity in Eastern Europe (Google)

Tracking cyber activity in Eastern Europe (Google)

The Callisto Group (F-Secure)

Suggest an edit to this article

Go to Cybersecurity Knowledge Base

Got to the Latest Cybersecurity News

Go to Cybersecurity Academy

Go to Homepage

Stay informed of the latest Cybersecurity trends, threats and developments. Sign up for our Weekly Cybersecurity Newsletter Today.

Remember, CyberSecurity Starts With You!

  • Globally, 30,000 websites are hacked daily.
  • 64% of companies worldwide have experienced at least one form of a cyber attack.
  • There were 20M breached records in March 2021.
  • In 2020, ransomware cases grew by 150%.
  • Email is responsible for around 94% of all malware.
  • Every 39 seconds, there is a new attack somewhere on the web.
  • An average of around 24,000 malicious mobile apps are blocked daily on the internet.
ClosePlease login
Just your average information security researcher from Delaware US.
User Avatar
Latest posts by RiSec.Mitch (see all)
Recommended:  "His ultimate goal is to destroy Ukraine" - Ukrainian foreign minister
Share the word, let's increase Cybersecurity Awareness as we know it
- Sponsored -

Sponsored Offer

Unleash the Power of the Cloud: Grab $200 Credit for 60 Days on DigitalOcean!

Digital ocean free 200

Discover more infosec

User Avatar
Just your average information security researcher from Delaware US.

more infosec reads

Subscribe for weekly updates