International military organisations targeted by cybercriminals

Researchers at Google’s Threat Analysis Group (TAG) published a blog post on 30 March 2022 about recent cyber attacks against international military structures by three well-identified cybercriminal groups.

COLDRIVER (or Calisto), based in Russia, has launched phishing campaigns against a wide range of targets: military organisations in several Eastern European countries, a Ukrainian defence contractor, the army of a Balkan country, American NGOs and think tanks, and even a NATO centre of excellence.

TAG also points to attacks by Curious Gorge (a China-linked group) against government and military organisations in Ukraine, Russia, Kazakhstan, and Mongolia.

Finally, Google researchers warn of a resurgence of Ghostwriter—a hacking operation accused of being affiliated with Russia—which targeted EU parliamentarians, officials, politicians, members of the press, and civil society in 2021.