Numerous companies and organizations including Global Ordnance, UMO Poland, Blue Sky Network, and The Commission for International Justice and Accountability have been impersonated by Russian state-sponsored threat group SEABORGIUM, also known as TA446, Callisto, and COLDDRIVER, to serve as lures in a phishing operation, according to The Record, a news site by cybersecurity firm Recorded Future.
SEABORGIUM has used 38 registered domains since January, including one spoofing the Microsoft login page of U.S. military weapons and hardware supplier Global Ordnance, a report from Recorded Future's Insikt Group showed.
NameCheap, Porkbun, REG.RU, and regway have been used to register most of the discovered domains, all of which had Let's Encrypt's X.509 TLS certificates.
"Analysis of the 9 domains reveals that 7 share a focus around industry verticals that would likely be of interest to Russia-nexus threat groups, especially in light of the war in Ukraine. The 2 outlier domains are probably intended to masquerade as the Ministry of Internal Affairs of the Russian Federation," said researchers.
Included in the exposed dataset labeled "PDL" were individuals' full names, email addresses, phone numbers, location data, professional summaries, and skills, as well as education and employment histories.
Attackers could leverage the issue — which impacts Nexus 3000, 7000, and 9000 series switches with vulnerable NX-OS versions with DHCPv6 activated and are in standalone NX-OS mode — to facilitate continuous crashes of the dhcp_snoop process and a denial-of-service condition.
Higher rewards of up to $250,000 will be given by Google for the discovery of memory corruption flaws in the Chrome browser shown to achieve remote code execution using a non-sandboxed process as part of a more robust vulnerability reward program.