Google says Russian espionage crew behind new malware campaign

[or1k]

Security experts at Google's Threat Analysis Group (TAG) have announced cyberattacks that they believe are linked to the Cold River hacker group. It, they claim, has ties to Russian intelligence services. The attacks are carried out using phishing techniques on targets in NATO countries, including the US and the UK. The group uses the SPICA backdoor to gain access to victims' computers and steal documents and cookies. 

The hackers send victims a PDF document that the sender claims contains an encrypted article and offers a decryption utility that is actually a backdoor. Google detected the active campaign and added Cold River-related domains and files to its Safe Browsing service database to protect users.