Cyber SecurityNews

Microsoft report on a sustained phishing campaign by the SEABORGIUM threat actor

Jason Davies 1545 Views 1 Comment ,  ,  2 min read

The Microsoft Threat Intelligence Center (MSTIC) has observed and taken actions to disrupt campaigns launched by SEABORGIUM, an actor Microsoft has tracked since 2017. SEABORGIUM is a threat actor that originates from Russia, with objectives and victimology that align closely with Russian state interests. Its campaigns involve persistent phishing and credential theft campaigns leading to intrusions and data theft. SEABORGIUM intrusions have also been linked to hack-and-leak campaigns, where stolen and leaked data is used to shape narratives in targeted countries.

Microsoft cannot rule out that supporting elements of the group may have current or prior affiliations with criminal or other nonstate ecosystems, MSTIC assesses that information collected during SEABORGIUM intrusions likely supports traditional espionage objectives and information operations as opposed to financial motivations.

SEABORGIUM is a highly persistent threat actor, frequently targeting the same organizations over long periods of time. Once successful, it slowly infiltrates targeted organizations’ social networks through constant impersonation, rapport building, and phishing to deepen their intrusion. SEABORGIUM has successfully compromised organizations and people of interest in consistent campaigns for several years, rarely changing methodologies or tactics.

Indicators of compromise (IOCs)

The below list provides IOCs observed during Microsoft’s investigation. Microsoft encourage customers to investigate these indicators in their environments and implement detections and protections to identify past related activity and prevent future attacks against their systems.

IndicatorTypeConfidencePublic References (if Applicable)
cache-dns[.]comDomain nameHighGoogle TAG, Sekoia.io
cache-dns-forwarding[.]comDomain nameHigh 
cache-dns-preview[.]comDomain nameHigh 
cache-docs[.]comDomain nameHighSekoia.io
cache-pdf[.]comDomain nameHigh 
cache-pdf[.]onlineDomain nameHigh 
cache-services[.]liveDomain nameHigh 
cloud-docs[.]comDomain nameHighSekoia.io
cloud-drive[.]liveDomain nameHigh 
cloud-storage[.]liveDomain nameHigh 
docs-cache[.]comDomain nameHighSekoia.io
docs-forwarding[.]onlineDomain nameHigh 
docs-info[.]comDomain nameHighSekoia.io
docs-shared[.]comDomain nameHighGoogle TAG, Sekoia.io
docs-shared[.]onlineDomain nameHigh 
docs-view[.]onlineDomain nameHigh 
document-forwarding[.]comDomain nameHigh 
document-online[.]liveDomain nameHigh 
document-preview[.]comDomain nameHigh 
documents-cloud[.]comDomain nameHighSekoia.io
documents-cloud[.]onlineDomain nameHighSekoia.io
documents-forwarding[.]comDomain nameHighGoogle TAG
document-share[.]liveDomain nameHigh 
documents-online[.]liveDomain nameHigh 
documents-pdf[.]onlineDomain nameHighSekoia.io
documents-preview[.]comDomain nameHighGoogle TAG
documents-view[.]liveDomain nameHigh 
document-view[.]liveDomain nameHigh 
drive-docs[.]comDomain nameHighSekoia.io
drive-share[.]liveDomain nameHighGoogle TAG, Sekoia.io
goo-link[.]onlineDomain nameHigh 
hypertextteches[.]comDomain nameHighSekoia.io
mail-docs[.]onlineDomain nameHigh 
officeonline365[.]liveDomain nameHigh 
online365-office[.]comDomain nameHigh 
online-document[.]liveDomain nameHigh 
online-storage[.]liveDomain nameHigh 
pdf-cache[.]comDomain nameHigh 
pdf-cache[.]onlineDomain nameHigh 
pdf-docs[.]onlineDomain nameHighSekoia.io
pdf-forwarding[.]onlineDomain nameHigh 
protection-checklinks[.]xyzDomain nameHigh 
protection-link[.]onlineDomain nameHigh 
protectionmail[.]onlineDomain nameHighSekoia.io
protection-office[.]liveDomain nameHighGoogle TAG, Sekoia.io
protect-link[.]onlineDomain nameHighGoogle TAG, Sekoia.io
proton-docs[.]comDomain nameHighSekoia.io
proton-reader[.]comDomain nameHigh 
proton-viewer[.]comDomain nameHighGoogle TAG, Sekoia.io
relogin-dashboard[.]onlineDomain nameHigh 
safe-connection[.]onlineDomain nameHigh 
safelinks-protect[.]liveDomain nameHigh 
secureoffice[.]liveDomain nameHigh 
webresources[.]liveDomain nameHighGoogle TAG
word-yand[.]liveDomain nameHigh 
yandx-online[.]cloudDomain nameHigh 
y-ml[.]coDomain nameHigh 
docs-drive[.]onlineDomain nameModerateSekoia.io
docs-info[.]onlineDomain nameModerate 
cloud-mail[.]onlineDomain nameModerate 
onlinecloud365[.]liveDomain nameModerate 
pdf-cloud[.]onlineDomain nameModerateSekoia.io
pdf-shared[.]onlineDomain nameModerateSekoia.io
proton-pdf[.]onlineDomain nameModerate 
proton-view[.]onlineDomain nameModerateSekoia.io
office365-online[.]liveDomain nameLow 
doc-viewer[.]comDomain nameLow 
file-milgov[.]systemsDomain nameLowSekoia.io
office-protection[.]onlineDomain nameLowSekoia.io

NOTE: These indicators should not be considered exhaustive for this observed activity.

Jason Davies

I am one of the editors here at www.systemtek.co.uk I am a UK based technology professional, with an interest in computer security and telecoms.

One thought on “Microsoft report on a sustained phishing campaign by the SEABORGIUM threat actor”

Leave a Reply

This site uses Akismet to reduce spam. Learn how your comment data is processed.