National labs targeted in Russia-based phishing scheme, Reuters reports

January 9, 2023, 12:01PMANS Nuclear Cafe

Reuters broke an “exclusive” story on January 6 that, “according to Internet records reviewed by Reuters and five cyber security experts, a Russian hacking team known as Cold River targeted three Department of Energy laboratoriesArgonne, Brookhaven, and Lawrence Livermore—with a phishing scheme in the summer of 2022.

Reuters reported that between August and September Cold River created fake login pages for each institution and then emailed lab employees hoping they would reveal their passwords on the fake websites. Reuters was unable to determine “why the labs were targeted or if any attempted intrusion was successful.”

The investigation: According to Reuters, Cold River first came to the attention of intelligence professionals after it targeted Britain's foreign office in 2016, and “has been involved in dozens of other high-profile hacking incidents in recent years, according to interviews with nine cybersecurity firms.

Reuters traced email accounts used in hacking operations between 2015 and 2020 to an IT worker in the Russian city of Syktyvkar and showed its findings to five industry experts, who confirmed the involvement of Cold River in the attempted nuclear labs hacks, based on shared digital fingerprints that researchers have historically tied to the group.

Personal email addresses used to set up Cold River missions reportedly belong to Andrey Korinets, a 35-year-old IT worker and bodybuilder in Syktyvkar, about 1,600 km (1,000 miles) northeast of Moscow.

According to Reuters, “Cold River made several missteps in recent years that allowed cybersecurity analysts to pinpoint the exact location and identity of one of its members, providing the clearest indication yet of the group's Russian origin, according to experts from Internet giant Google, British defense contractor BAE, and U.S. intelligence firm Nisos.”

No comment: According to Reuters, several entities contacted by reporters either did not respond to a request for comment or declined to provide comments, including the three national laboratories, the DOE, the U.S. National Security Agency, the U.K. Global Communications Headquarters, the U.K. foreign office, Russia's Federal Security Service, and Russia's embassy in Washington, D.C.


Related Articles

Enriching nuclear’s human element

February 7, 2023, 7:02AMNuclear News

This month’s Nuclear News focuses on the challenges of building and maintaining a strong, productive nuclear technology workforce. While my sense is that U.S. nuclear is in significant...

A review of workforce trends in the nuclear community

A Nuclear News interview with Kostas Dovas and Darren Stiles

February 3, 2023, 3:01PMNuclear News

The nuclear community is undergoing a moment of unprecedented interest and growth not seen in decades. The passage of the bipartisan Infrastructure Investment and Jobs Act and the Inflation...