The Security Brief

Tag: intelligence

  • Doppelgänger Was Just the Beginning

    Doppelgänger Was Just the Beginning

    Rethinking Russian Influence Operations in the Age of Weaponized Visibility

    Earlier this month, Sweden’s Psychological Defence Agency and Lund University released Beyond Operation Doppelgänger, a 200-page deep dive into the capabilities of Russia’s Social Design Agency (SDA). While most public reporting has focused on the now-infamous mirror sites used to spread fake news, this report makes a clear case that those cloned websites were just one piece of a much broader, and more enduring, strategy.

    According to the authors, SDA isn’t some freelance influence shop. It’s part of a well-funded, Kremlin-directed propaganda network that merges digital marketing tactics with political messaging, psychological ops, and elements of classic espionage. This ecosystem is not designed to convince people of a particular narrative. It’s built to persist, to stay present, and to dominate the conversation. Success isn’t measured by belief, it’s measured by visibility.

    What the Report Really Tells Us

    Doppelgänger was not the operation, it was a delivery method

    Those cloned news sites? One tactic among many. The report makes it clear that SDA’s influence work goes far beyond any one campaign. Doppelgänger was part of a series of coordinated “counter-campaigns” aimed at Europe, Ukraine, the United States, and beyond.

    SDA uses attention, not persuasion, to justify effectiveness

    The goal isn’t to get people to agree, it’s to make sure Russian messaging shows up in the conversation. If a piece of content gets fact-checked, reported on, or criticized, that’s considered a win. The more visibility these campaigns get, the more SDA is rewarded by its Kremlin backers.

    The leaks could have been deliberate

    One of the more provocative angles in the report is the suggestion that some of the leaked SDA documents might have been released on purpose. Whether the goal was to overload researchers, build internal prestige, or tie up resources while new infrastructure was being built, the leak may have been a calculated move.

    Narratives are interchangeable, presence is the goal

    SDA isn’t wedded to any particular storyline. The messages are interchangeable. If a campaign, whether it’s a meme, a bot swarm, or a fake news drop, gets traction, it’s scaled up. If it doesn’t, it’s dropped. The point is to flood the zone, not to persuade.

    Some Questions Worth Asking?

    This report calls into question a lot of our assumptions about what influence operations are trying to do—and how we should be responding. A few questions that come to mind:

    • If visibility is the goal, not the risk, how do defenders responsibly counter disinformation without amplifying it?
    • Are we unintentionally helping adversaries by publicizing their operations too effectively?
    • Where is the line between countering propaganda and participating in its feedback loop?
    • Are our current frameworks designed to deal with long-term influence ecosystems or only isolated events?
    • Are we seeing the emergence of a disinformation-industrial complex, where performance metrics and funding cycles shape how propaganda is created and sustained?

    Beyond Operation Doppelgänger doesn’t just describe a disinformation campaign, it maps out a system that adapts, exploits visibility, and treats media attention, sanctions, and cyber takedowns as signals of progress.

    It’s not about changing minds. It’s about owning space…

    Link to full report here:https://mpf.se/psychological-defence-agency/publications/archive/2025-05-15-beyond-operation-doppelganger-a-capability-assessment-of-the-social-design-agency

  • COLDRIVER’s New LOSTKEYS Malware Targets Western Officials

    COLDRIVER’s New LOSTKEYS Malware Targets Western Officials

    Summary

    Between Jan and Apr 2025, suspected Russian FSB-linked threat group COLDRIVER delivered LOSTKEYS malware using a fake CAPTCHA to target Western officials, journalists, think tanks, and NGOs.

    Russian Threat Group COLDRIVER Deploys LOSTKEYS Malware Targeting Western Entities

    The Russian state-sponsored threat group, COLDRIVER (aka UNC4057, Callisto, and Star Blizzard), has expanded its cyberespionage toolkit with the additional of a new malware strain dubbed LOSTKEYS. According to Google’s Threat Intelligence Group (GTIG), this development marks a significant evolution from COLDRIVER’s usual credential phishing tactics to more sophisticated malware development.

    Evolution of Tactics

    Historically, COLDRIVER focused on credential phishing campaigns targeting high-profile individuals in NATO governments, NGOs, and former intelligence and diplomatic officials. The threat group’s primary objective has been intelligence collection in support of Russian strategic interests. More recent activities observed in early-2025 indicate a shift towards deploying more custom malware to further enhance their data exfiltration capabilities.

    Introduction of LOSTKEYS

    LOSTKEYS was designed to steal files from predefined directories and file types, as well as send system information and running processes back to the threat actors. The malware is delivered through a multi-stage infection chain that begins with a lure website featuring a fake CAPTCHA. Once a target interacts with the CAPTCHA, they’re then prompted to execute a PowerShell script, starting the malware installation process. This method, known as “ClickFix”, involves socially engineering targets to copy, paste, and execute malicious PowerShell commands. The technique has been gaining increased notoriety as various other threat actors have begun leveraging it.

    Targets and Objectives

    COLDRIVER’s recent campaigns have targeted current and former advisors to Western governments, militaries, journalists, think tanks, NGOs, and individuals connected to Ukraine. The group’s operations aim to gather intelligence that aligns with Russian strategic interests. In some cases, COLDRIVER has been linked to hack-and-leak campaigns targeting officials in the UK and NGOs.

    Analyst Comments:

    The evolution of COLDRIVER from basic credential phishing to deploying custom malware like LOSTKEYS emphasizes a broader trend in Russian cyberespionage: the increasing willingness to burn bespoke tools in pursuit of higher value intelligence collection. The shift seems to suggest mounting pressure on Russian intelligence services to deliver actionable insights amid ongoing geopolitical tensions, particularly related to NATO support for Ukraine and Western policy responses.

    Through their targeting of advisors, think tanks, and NGOs, COLDRIVER is focusing on influencers and policy shapers, not just government officials. This indicates a strategic effort of preempting or shaping foreign policy decisions. Their adoption of techniques like ClickFix also signals an emphasis on user-driven execution, a smart bypass of traditional email defenses and endpoint controls. As we’ve seen in the past, employees are the weakest link in an organization’s security posture.

    For us network defenders, this campaign highlights the importance of defense-in depth strategies, user education (a must), and proactive threat hunting. The fact that COLDRIVER now deploys malware directly onto victim systems raises the stakes for organizations previously focused only on account compromise prevention.

    In short, COLDRIVER’s operational pivot is just another reminder that cyberespionage groups adapt faster than most defensive postures. Organizations in policy-adjacent sectors should assume they are in the targeting scope, even if they don’t handle classified information, and adjust security postures accordingly.

    Reference(s) and Further Reading:

    https://cloud.google.com/blog/topics/threat-intelligence/coldriver-steal-documents-western-targets-ngos

    https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-341a

    https://home.treasury.gov/news/press-releases/jy1962

  • The Escalation of GRU Unit 29155: Espionage and Sabotage Tactics

    The Escalation of GRU Unit 29155: Espionage and Sabotage Tactics

    Disclaimer: This post is based on unclassified, open-source reporting and reflects my personal analysis and interpretations. The views expressed here are my own and do not represent the views or positions of my employer.

    Background

    Russian GRU military intelligence Unit 29155 (aka Cadet Blizzard, Ember Bear, FrozenVista, UNC2589) is a covert subunit of the Main Directorate of the General Staff of the Armed Forces of the Russian Federation (GRU), primarily tasked with conducting high-stakes and clandestine operations abroad. Established under the GRU, Unit 29155 gained public attention due to its involvement in activities that align with Russia’s asymmetric warfare objectives, particularly in Europe, Ukraine, and NATO-affiliated regions. Unit 29155 operates in several domains, from traditional espionage and sabotage to cyber operations.

    Unit 29155 has significantly intensified operations since 2020, pivoting from covert actions in Europe toward a greater emphasis on cyber operations with a focus on undermining Ukraine and NATO allies through espionage, data manipulation, and sabotage.

    Primary TTPs

    • Espionage and Data Theft
      • Unit 29155 conducts extensive espionage campaigns aimed at gathering intelligence from NATO countries, European union members, and multiple nations in Latin America and Central Asian. They’ve exploited critical infrastructure and government systems leveraging reconnaissance tools like Nmap and Shodan to scan for vulnerabilities and gather intelligence [2].
      • Sensitive information obtained through these operations are occasionally leaked or shared publicly in order to damage the reputations of their victims as part of influence efforts [3].
    • Destructive Operations
      • Unit 29155 was tracked as the group deploying the destructive WhisperGate malware, disguised as ransomware but meant to erase victim data. This wiper was used in targeting of Ukrainian governmental and critical infrastructure entities. This activity provided evidence of a clear shift to sabotage tactics aligned with Russian military objectives early in the Russia/Ukraine conflict.
      • Destructive attacks have also been directed towards logistics operations supporting Ukraine, as seen in repeated attacks against infrastructure crucial to NATO and EU support for Ukraine [2].
    • Infrastructure Scanning/Domain Enumeration
      • Unit 29155 engaged in over 14,000 documented cases of domain scanning, targeting NATO infrastructure and EU entities. The scanning has been described as preparatory, often identifying weak points for later exploitation efforts. Open-source and custom tools like Acunetix, WPScan, and VirusTotal were commonly used for this reconnaissance [3].
    • Cybercriminal Overlap
      • Not wholly unique to Unit 29155, but rather the broad spectrum of Russian state-sponsored APT groups, researchers report collaboration with known cybercriminal elements, employing non-GRU actors to facilitate operations. This working relationship extends the group’s reach and allows it to exploit technical expertise outside formal military ranks while obscuring attribution. It is also believed that this particular unit consists of primarily junior personnel and so may operate at a less sophisticated level than other groups like APT28 or APT29 [4].

    Mitigations and Recommendations

    Cyber defenders across critical sectors are encouraged to implement mitigations against known tactics:

    • Prioritize patching of known vulnerabilities and enforce multi-factor authentication (MFA).
    • Monitor networks for unusual scanning or reconnaissance activity and segment networks to mitigate lateral movement, post infiltration.
    • Use intrusion detection tools to monitor for technical indicators of compromise (IOCs) relating to Unit 29155.

    Unit 29155’s evolution highlights a blend of traditional espionage with enhanced cyber and sabotage capabilities, particularly in relation to high-stakes geopolitical targets. The expanded use of cyber tactics show the importance for affected nations and organizations to maintain vigilance and robust cyber defenses.

    References

    [1] https://www.fbi.gov/wanted/cyber/gru-29155-cyber-actors

    [2] https://www.nsa.gov/Press-Room/Press-Releases-Statements/Press-Release-View/Article/3895808/%5B3%5D https://www.cyber.gov.au/about-us/view-all-content/alerts-and-advisories/russian-military-cyber-actors-target-us-and-global-critical-infrastructure

    [4] https://www.rferl.org/a/germany-gru-russia-cyber-warning/33112764.html