{"id":45999,"date":"2022-04-01T10:20:10","date_gmt":"2022-04-01T10:20:10","guid":{"rendered":"https:\/\/www.threatshub.org\/blog\/google-russian-credential-thieves-target-nato-eastern-european-military\/"},"modified":"2022-04-01T10:20:10","modified_gmt":"2022-04-01T10:20:10","slug":"google-russian-credential-thieves-target-nato-eastern-european-military","status":"publish","type":"post","link":"https:\/\/www.threatshub.org\/blog\/google-russian-credential-thieves-target-nato-eastern-european-military\/","title":{"rendered":"Google: Russian credential thieves target NATO, Eastern European military"},"content":{"rendered":"

A Russian cybercrime gang has lately sent credential-phishing emails to the military of Eastern European countries and a NATO Center of Excellence, according to a Google threat report this week. <\/p>\n

The web giant calls the Russia-based group Coldriver, and notes it’s also known as Calisto. The cyber-gang used newly created Gmail accounts in its attempts to phish non-Gmail accounts, so Google can’t verify the success rate of the campaigns, wrote<\/a> Googler Billy Leonard, a member of the cloud titan’s Threat Analysis Group.<\/p>\n

In a report that covers active threat actor groups observed over the past two weeks, Leonard said his fellow security analysts have seen a “continuously growing number” of government-backed gangs from China, Iran, North Korea, and Russia using Ukraine-war themes to get their targets to open malicious emails and links. These messages and URLs are used to spread malware or get people to enter their usernames and passwords into pages designed to look like login pages for legit websites.<\/p>\n