WASHINGTON -UNS/Reuters – A Russian hacking team known as Cold River targeted three nuclear research laboratories in the United States this past summer, according to internet records reviewed by Reuters and five cyber security experts.
Between August and September, as President Vladimir Putin indicated Russia would be willing to use nuclear weapons to defend its territory, Cold River targeted the Brookhaven (BNL), Argonne (ANL) and Lawrence Livermore National Laboratories (LLNL), according to internet records that showed the hackers creating fake login pages for each institution and emailing nuclear scientists in a bid to make them reveal their passwords.
Reuters was unable to determine why the labs were targeted or if any attempted intrusion was successful. A BNL spokesperson declined to comment. LLNL did not respond to a request for comment. An ANL spokesperson referred questions to the U.S. Department of Energy, which declined to comment.
Cold River has escalated its hacking campaign against Kyiv s allies since the invasion of Ukraine, according to cybersecurity researchers and western government officials. The digital blitz against the U.S. labs occurred as U.N. experts entered Russian-controlled Ukrainian territory to inspect Europe s biggest atomic power plant and assess the risk of what both sides said could be a devastating radiation disaster amid heavy shelling nearby.
Cold River, which first appeared on the radar of intelligence professionals after targeting Britain s foreign office in 2016, has been involved in dozens of other high-profile hacking incidents in recent years, according to interviews with nine cybersecurity firms. Reuters traced email accounts used in its hacking operations between 2015 and 2020 to an IT worker in the Russian city of Syktyvkar.
“This is one of the most important hacking groups you’ve never heard of,” said Adam Meyer, senior vice president of intelligence at U.S. cybersecurity firm CrowdStrike. “They are involved in directly supporting Kremlin information operations.”
Advertisement · Scroll to continue
Russia s Federal Security Service (FSB), the domestic security agency that also conducts espionage campaigns for Moscow, and Russia s embassy in Washington did not respond to emailed requests for comment.
Western officials say the Russian government is a global leader in hacking and uses cyber-espionage to spy on foreign governments and industries to seek a competitive advantage. However, Moscow has consistently denied that it carries out hacking operations.
Reuters showed its findings to five industry experts who confirmed the involvement of Cold River in the attempted nuclear labs hacks, based on shared digital fingerprints that researchers have historically tied to the group.
The U.S. National Security Agency (NSA) declined to comment on Cold River s activities. Britain s Global Communications Headquarters (GCHQ), its NSA equivalent, did not comment. The foreign office declined to comment.
INTELLIGENCE COLLECTION
In May, Cold River broke into and leaked emails belonging to the former head of Britain s MI6 spy service. That was just one of several hack and leak operations last year by Russia-linked hackers in which confidential communications were made public in Britain, Poland and Latvia, according to cybersecurity experts and Eastern European security officials.
In another recent espionage operation targeting critics of Moscow, Cold River registered domain names designed to imitate at least three European NGOs investigating war crimes, according to French cybersecurity firm SEKOIA.IO.
The NGO-related hacking attempts occurred just before and after the October 18 launch of a report by a U.N. independent commission of enquiry that found Russian forces were responsible for the “vast majority” of human rights violations in the early weeks of the Ukraine war, which Russia has called a special military operation.
In a blog post, SEKOIA.IO said that, based on its targeting of the NGOs, Cold River was seeking to contribute to “Russian intelligence collection about identi�
