SEABORGIUM APT Group Targets NATO Members and European Countries

A report published by Microsoft details of a threat actor named “SEABORGIUM”, which the vendor attributed to Russia, that targeted organizations in NATO member countries as well as in Northern and Eastern Europe for espionage. Also referred as Callisto, TA446 and COLDRIVER, the threat actor has been active since 2015 and reportedly used spyware developed by the infamous ‘HackingTeam’ in their earlier campaigns.

Why is this Significant?

This is significant because the “SEABORGIUM” threat actor has been active since 2015 and reportedly targeted various industries including defense contractors, think tanks, Non-Governmental Organizations (NGOs) and Intergovernmental Organizations (IGOs) in NATO member countries as well as other European countries for espionage.

What is SEABORGIUM APT Group?

SEABORGIUM is a threat actor that has reportedly targeted organizations that are associated with foreign and security policy making in Europe for at least seven years. Countries of interest include NATO partner nations as well as countries in Northern, Southern and Eastern Europe. The Microsoft blog indicates that the APT group targeted Ukraine’s public sector prior to the ongoing Russo-Ukrainian war.

The SEABORGIUM APT threat actor is also known as Callisto Group (Callisto), COLDRIVER, TA446, and is potentially related to Gamaredon Group.

Infection tactics of SEABORGIUM include credential phishing attacks, sending a Word doc attachment with malware embedded or malicious macros, and sending emails with themes that the target is likely interested in; also establishing relationships on Social Networking Service (SNS), all presumably for email credential theft. The stolen credentials allow the threat actor to gain access to the victim’s mailbox and exfiltrate information. The attacker also is believed to set up email rules in the victim’s mailboxes that automatically forward incoming messages to the attacker’s email address for data gathering.

In earlier campaigns, the SEABORGIUM APT group is believed to have used the Scout implant from Galileo, one of the Remote Control Systems (RCS) developed by the infamous Italy-based HackingTeam. The Scout agent sends victim’s machine information and screen captures to the attacker’s infrastructure.

Appendix

Disrupting SEABORGIUM’s ongoing phishing operations (Microsoft)

Update on cyber activity in Eastern Europe (Google)

Tracking cyber activity in Eastern Europe (Google)

The Callisto Group (F-Secure)

Suggest an edit to this article

Go to Cybersecurity Knowledge Base

Got to the Latest Cybersecurity News

Go to Cybersecurity Academy

Go to Homepage

Stay informed of the latest Cybersecurity trends, threats and developments. Sign up for our Weekly Cybersecurity Newsletter Today.

Remember, CyberSecurity Starts With You!

• Globally, 30,000 websites are hacked daily.
• 64% of companies worldwide have experienced at least one form of a cyber attack.
• There were 20M breached records in March 2021.
• In 2020, ransomware cases grew by 150%.
• Email is responsible for around 94% of all malware.
• Every 39 seconds, there is a new attack somewhere on the web.
• An average of around 24,000 malicious mobile apps are blocked daily on the internet.