Microsoft has disrupted suspected Russian state-sponsored advanced persistent threat group SEABORGIUM, which has been launching cyberespionage attacks against government officials, military officials, journalists, and think tanks across Europe and South Caucasus during the past five years, SecurityWeek reports.
SEABORGIUM had indicators of compromise and tactics overlapping with earlier reports from Google and F-Secure, which have dubbed the APT as COLDRIVER and Callisto Group, respectively, according to a Microsoft report.
Aside from exploiting OneDrive to host malicious documents included in their phishing emails, SEABORGIUM also leveraged fraudulent LinkedIn accounts in their persistent phishing, data theft, and credential theft campaigns. Researchers were also able to observe that some SEABORGIUM campaigns involved the creation of forwarding rules from the inboxes of their victims to accounts under their control.
"On more than one occasion, we have observed that the actors were able to access mailing-list data for sensitive groups, such as those frequented by former intelligence officials, and maintain a collection of information from the mailing-list for follow-on targeting and exfiltration," said Microsoft.
Included in the exposed dataset labeled "PDL" were individuals' full names, email addresses, phone numbers, location data, professional summaries, and skills, as well as education and employment histories.
Attackers could leverage the issue — which impacts Nexus 3000, 7000, and 9000 series switches with vulnerable NX-OS versions with DHCPv6 activated and are in standalone NX-OS mode — to facilitate continuous crashes of the dhcp_snoop process and a denial-of-service condition.
Higher rewards of up to $250,000 will be given by Google for the discovery of memory corruption flaws in the Chrome browser shown to achieve remote code execution using a non-sandboxed process as part of a more robust vulnerability reward program.