Russian Cyberspies Elevate Their Game: Sophisticated Phishing Targets US, European, and Russian Civil Society

Wednesday 14 August 2024 - 14:00

A recent report has unveiled increasingly sophisticated phishing attacks originating from Russia's state security agency. These attacks, targeting members of US, European, and Russian civil society, have reached unprecedented levels of complexity, sometimes even impersonating individuals closely associated with the targets.

The groundbreaking investigation, conducted jointly by the Citizen Lab at the University of Toronto and Access Now, sheds light on the intricate methods employed by Russian state-sponsored hackers. This revelation comes as the FBI is separately probing suspected Iranian hacking attempts against a Donald Trump adviser and members of the Harris-Walz campaign team.

While state-sponsored hacking campaigns aimed at influencing political processes are not new—as evidenced by the Russian-linked cyber attacks on Hillary Clinton's campaign in 2016—researchers assert that the latest Russian efforts demonstrate a significant leap in both social engineering strategies and technical sophistication.

Among the high-profile targets of these recent attacks were Steven Pifer, former US ambassador to Ukraine, and Polina Machold, an exiled Russian publisher whose news organization, Proekt Media, had conducted notable investigations into Russian President Vladimir Putin and Chechen head Ramzan Kadyrov.

In Pifer's case, the attack was initiated through what researchers described as a "highly credible" exchange involving an impersonator posing as another former US ambassador known to Pifer. Machold's experience was equally cunning. The publisher, who relocated to Germany after being expelled from Russia in 2021, was contacted via email by a purported professional acquaintance. The exchange, which began innocuously, eventually led to a sophisticated phishing attempt using Proton Mail, a secure email service favored by journalists.

Machold recounted the incident: "I had not seen anything like this before. They knew I had contacts with this person. I didn't have a clue even though I consider myself to be on high alert," she stated, adding, "It's clear that anyone connected to the Russian opposition could be a target. They need as much information as they can get."

The researchers identified two primary threat actors behind these campaigns: Coldriver, attributed to Russia's Federal Security Service (FSB) by multiple governments, and Coldwastrel, which demonstrated similar targeting patterns and interests aligned with Russian objectives.

Natalia Krapiva, senior tech legal counsel at Access Now, emphasized the gravity of the situation: "This investigation shows that Russian independent media and human rights groups in exile face the same type of advanced phishing attacks that target current and former US officials. Yet they have many fewer resources to protect themselves, and the risks of compromise are much more severe."

The majority of the targets who cooperated with the researchers chose to remain anonymous for safety reasons. However, they were described as prominent Russian opposition figures in exile, non-governmental staff in the US and Europe, funders, and media organizations. A common thread among most targets was their "extensive networks among sensitive communities."

The modus operandi of these attacks typically involves the threat actor initiating an email exchange with the target while masquerading as a known contact. The attacker then requests the target to review a document, often a PDF purportedly encrypted using a privacy-focused service like Proton Drive. The login page may even be pre-populated with the target's email address to enhance credibility. If the target enters their password and a two-factor code, the attacker gains access to crucial information, potentially compromising the target's email account.

Rebekah Brown, a senior researcher at the Citizen Lab, warned of the immediate consequences of such breaches: "As soon as these attackers get credentials, we think they will work immediately to access email accounts and any online storage, like Google Drive, to pull as much sensitive information as they can. There are immediate risks to life and safety, especially if information concerning people still in Russia is in those accounts."

This report serves as a stark reminder of the ongoing cyber warfare being waged in the shadows of global politics. As state-sponsored hackers continue to refine their techniques, the need for robust cybersecurity measures and increased awareness among potential targets has never been more critical. The implications of these sophisticated attacks extend far beyond individual compromises, potentially influencing geopolitical dynamics and threatening the safety of vulnerable individuals and organizations worldwide.

As the cyber landscape continues to evolve, it is clear that the battle against state-sponsored hacking will require constant vigilance, innovative security measures, and international cooperation to safeguard the integrity of civil society and democratic institutions.