{"id":2509,"date":"2026-10-05T14:16:40","date_gmt":"2026-10-05T11:16:40","guid":{"rendered":"https:\/\/digitalskills.lt\/?p=2509"},"modified":"2026-10-05T14:29:06","modified_gmt":"2026-10-05T11:29:06","slug":"","status":"publish","type":"post","link":"https:\/\/digitalskills.lt\/en\/2026\/10\/05\/moldova-civil-society-media-cyberattack-cold-river\/","title":{"rendered":"Alert: Attack on Moldovan Civil Society and Media Organizations, Resembling Cold River's Tactics","raw":"Alert: Attack on Moldovan Civil Society and Media Organizations, Resembling Cold River's Tactics"},"content":{"rendered":"\n<figure class=\"wp-block-image size-large\"><span itemprop=\"image\" itemscope itemtype=\"https:\/\/schema.org\/ImageObject\"><img itemprop=\"url image\" loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"342\"  src=\"https:\/\/digitalskills.lt\/wp-content\/uploads\/2026\/10\/image-2-1024x342.png\" alt=\"\" class=\"wp-image-2512\" srcset=\"https:\/\/digitalskills.lt\/wp-content\/uploads\/2026\/10\/image-2-1024x342.png 1024w, https:\/\/digitalskills.lt\/wp-content\/uploads\/2026\/10\/image-2-600x200.png 600w, https:\/\/digitalskills.lt\/wp-content\/uploads\/2026\/10\/image-2-766x256.png 766w, https:\/\/digitalskills.lt\/wp-content\/uploads\/2026\/10\/image-2-900x301.png 900w, https:\/\/digitalskills.lt\/wp-content\/uploads\/2026\/10\/image-2-1536x513.png 1536w, https:\/\/digitalskills.lt\/wp-content\/uploads\/2026\/10\/image-2-870x291.png 870w, https:\/\/digitalskills.lt\/wp-content\/uploads\/2026\/10\/image-2-2048x684.png 2048w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><meta itemprop=\"width\" content=\"1024\"><meta itemprop=\"height\" content=\"342\"><\/span><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">The Digital Skills Coalition Belarus team wants to flag a finding from our colleagues at RESIDENT.NGO.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Cold River (also known as Star Blizzard), a hacking group linked to Russian state security services, has for years been known for attacking journalists, NGOs, and activists through fake emails impersonating familiar organizations. The RESIDENT.NGO team uncovered a campaign that closely resembles their tactics: in September 2026, attackers sent Moldovan media outlets and civil society organizations emails impersonating European donors, attempting to infect computers with malware. Researchers aren&#8217;t fully certain this is Cold River, but the techniques match almost exactly. Here&#8217;s what RESIDENT.NGO found and what to do if someone in our circle receives a similar email.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>What to do if you receive a suspicious email<\/strong><\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>A legitimate donor never sends a proposal or invitation as a virtual disk file (.vhdx, .iso, .img extensions) or as a password-protected archive with the password written in the same email. This alone is a sign of an attack, don&#8217;t open such a file.<\/li>\n\n\n\n<li>If an offer or invitation is unexpected, verify it through a channel you already know (for example, call the organization directly) before replying or opening anything.<\/li>\n\n\n\n<li>If a suspicious file has already been opened on a Windows computer, disconnect the device from the network immediately (turn off Wi-Fi\/unplug the cable) and contact a security specialist.<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>What RESIDENT.NGO found<\/strong><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">It starts with an ordinary, friendly email: an invitation to a conference or a grant offer in the name of a real, well-known organization (in this case, European Business Summits, the European Endowment for Democracy, and East Europe Foundation Moldova). The sender&#8217;s name is familiar, but the email address is fake.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">If the person replies and shows interest, they&#8217;re sent a password-protected archive (the password is given in the email itself). Inside is not an ordinary document but a virtual disk image file. Opening it shows a convincing PDF with the proposal, while in the background a malicious program is quietly installed: it contacts the attacker&#8217;s server and can download additional malicious modules at any time.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">What makes this especially sneaky is that Windows&#8217; usual warning about files downloaded from the internet may not trigger in this case, so nothing looks suspicious at a glance.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Read more<\/strong><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The full technical report from RESIDENT.NGO, with attack details, indicators of compromise, and screenshots, is published on their site:<br>\ud83d\udc49 <a href=\"https:\/\/resident.ngo\/lab\/writeups\/malware-campaign-impersonates-european-donors-to-target-moldovan-media-and-civil-society\/\">resident.ngo\/lab\/writeups\/malware-campaign-impersonates-european-donors-to-target-moldovan-media-and-civil-society<\/a><\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><\/p>\n","protected":false,"raw":"<!-- wp:image {\"id\":2512,\"sizeSlug\":\"large\",\"linkDestination\":\"none\"} -->\n<figure class=\"wp-block-image size-large\"><img src=\"https:\/\/digitalskills.lt\/wp-content\/uploads\/2026\/10\/image-2-1024x342.png\" alt=\"\" class=\"wp-image-2512\"\/><\/figure>\n<!-- \/wp:image -->\n\n<!-- wp:paragraph -->\n<p>The Digital Skills Coalition Belarus team wants to flag a finding from our colleagues at RESIDENT.NGO.<\/p>\n<!-- \/wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Cold River (also known as Star Blizzard), a hacking group linked to Russian state security services, has for years been known for attacking journalists, NGOs, and activists through fake emails impersonating familiar organizations. The RESIDENT.NGO team uncovered a campaign that closely resembles their tactics: in September 2026, attackers sent Moldovan media outlets and civil society organizations emails impersonating European donors, attempting to infect computers with malware. Researchers aren't fully certain this is Cold River, but the techniques match almost exactly. Here's what RESIDENT.NGO found and what to do if someone in our circle receives a similar email.<\/p>\n<!-- \/wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>What to do if you receive a suspicious email<\/strong><\/p>\n<!-- \/wp:paragraph -->\n\n<!-- wp:list -->\n<ul class=\"wp-block-list\"><!-- wp:list-item -->\n<li>A legitimate donor never sends a proposal or invitation as a virtual disk file (.vhdx, .iso, .img extensions) or as a password-protected archive with the password written in the same email. This alone is a sign of an attack, don't open such a file.<\/li>\n<!-- \/wp:list-item -->\n\n<!-- wp:list-item -->\n<li>If an offer or invitation is unexpected, verify it through a channel you already know (for example, call the organization directly) before replying or opening anything.<\/li>\n<!-- \/wp:list-item -->\n\n<!-- wp:list-item -->\n<li>If a suspicious file has already been opened on a Windows computer, disconnect the device from the network immediately (turn off Wi-Fi\/unplug the cable) and contact a security specialist.<\/li>\n<!-- \/wp:list-item --><\/ul>\n<!-- \/wp:list -->\n\n<!-- wp:paragraph -->\n<p><strong>What RESIDENT.NGO found<\/strong><\/p>\n<!-- \/wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>It starts with an ordinary, friendly email: an invitation to a conference or a grant offer in the name of a real, well-known organization (in this case, European Business Summits, the European Endowment for Democracy, and East Europe Foundation Moldova). The sender's name is familiar, but the email address is fake.<\/p>\n<!-- \/wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>If the person replies and shows interest, they're sent a password-protected archive (the password is given in the email itself). Inside is not an ordinary document but a virtual disk image file. Opening it shows a convincing PDF with the proposal, while in the background a malicious program is quietly installed: it contacts the attacker's server and can download additional malicious modules at any time.<\/p>\n<!-- \/wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>What makes this especially sneaky is that Windows' usual warning about files downloaded from the internet may not trigger in this case, so nothing looks suspicious at a glance.<\/p>\n<!-- \/wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Read more<\/strong><\/p>\n<!-- \/wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The full technical report from RESIDENT.NGO, with attack details, indicators of compromise, and screenshots, is published on their site:<br>\ud83d\udc49 <a href=\"https:\/\/resident.ngo\/lab\/writeups\/malware-campaign-impersonates-european-donors-to-target-moldovan-media-and-civil-society\/\">resident.ngo\/lab\/writeups\/malware-campaign-impersonates-european-donors-to-target-moldovan-media-and-civil-society<\/a><\/p>\n<!-- \/wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><\/p>\n<!-- \/wp:paragraph -->"},"excerpt":{"rendered":"","protected":false,"raw":""},"author":1,"featured_media":2514,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"advgb_blocks_editor_width":"","advgb_blocks_columns_visual_guide":"","_ru_post_content":"<!-- wp:image {\"id\":2511,\"sizeSlug\":\"large\",\"linkDestination\":\"none\"} -->\n<figure class=\"wp-block-image size-large\"><img src=\"https:\/\/digitalskills.lt\/wp-content\/uploads\/2026\/10\/image-1-1024x341.png\" alt=\"\" class=\"wp-image-2511\"\/><\/figure>\n<!-- \/wp:image -->\n\n<!-- wp:paragraph -->\n<p>\u041a\u043e\u043c\u0430\u043d\u0434\u0430 <strong>Digital Skills Coalition Belarus<\/strong> \u0445\u043e\u0447\u0435\u0442 \u043e\u0431\u0440\u0430\u0442\u0438\u0442\u044c \u0432\u0430\u0448\u0435 \u0432\u043d\u0438\u043c\u0430\u043d\u0438\u0435 \u043d\u0430 \u043d\u0430\u0445\u043e\u0434\u043a\u0443 \u043a\u043e\u043b\u043b\u0435\u0433 \u0438\u0437 <strong>RESIDENT.NGO<\/strong>.<\/p>\n<!-- \/wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>\u0413\u0440\u0443\u043f\u043f\u0430 Cold River (\u0435\u0451 \u0442\u0430\u043a\u0436\u0435 \u043d\u0430\u0437\u044b\u0432\u0430\u044e\u0442 Star Blizzard), \u0445\u0430\u043a\u0435\u0440\u044b, \u0441\u0432\u044f\u0437\u0430\u043d\u043d\u044b\u0435 \u0441 \u0440\u043e\u0441\u0441\u0438\u0439\u0441\u043a\u0438\u043c\u0438 \u0441\u043f\u0435\u0446\u0441\u043b\u0443\u0436\u0431\u0430\u043c\u0438, \u0443\u0436\u0435 \u043c\u043d\u043e\u0433\u043e \u043b\u0435\u0442 \u0438\u0437\u0432\u0435\u0441\u0442\u043d\u044b \u0442\u0435\u043c, \u0447\u0442\u043e \u0430\u0442\u0430\u043a\u0443\u044e\u0442 \u0436\u0443\u0440\u043d\u0430\u043b\u0438\u0441\u0442\u043e\u0432, \u041d\u041a\u041e \u0438 \u0430\u043a\u0442\u0438\u0432\u0438\u0441\u0442\u043e\u0432 \u0447\u0435\u0440\u0435\u0437 \u043f\u043e\u0434\u0434\u0435\u043b\u044c\u043d\u044b\u0435 \u043f\u0438\u0441\u044c\u043c\u0430 \u043e\u0442 \u0438\u043c\u0435\u043d\u0438 \u0437\u043d\u0430\u043a\u043e\u043c\u044b\u0445 \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0439. <\/p>\n<!-- \/wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>\u041a\u043e\u043c\u0430\u043d\u0434\u0430 <strong>RESIDENT.NGO<\/strong> \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0438\u043b\u0430 \u043a\u0430\u043c\u043f\u0430\u043d\u0438\u044e, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u043e\u0447\u0435\u043d\u044c \u043f\u043e\u0445\u043e\u0436\u0430 \u043d\u0430 \u0438\u0445 \u043f\u043e\u0447\u0435\u0440\u043a: \u0432 \u0441\u0435\u043d\u0442\u044f\u0431\u0440\u0435 2026 \u0433\u043e\u0434\u0430 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0438 \u0440\u0430\u0441\u0441\u044b\u043b\u0430\u043b\u0438 \u043c\u043e\u043b\u0434\u0430\u0432\u0441\u043a\u0438\u043c \u043c\u0435\u0434\u0438\u0430 \u0438 \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u044f\u043c \u0433\u0440\u0430\u0436\u0434\u0430\u043d\u0441\u043a\u043e\u0433\u043e \u043e\u0431\u0449\u0435\u0441\u0442\u0432\u0430 \u043f\u0438\u0441\u044c\u043c\u0430 \u043e\u0442 \u0438\u043c\u0435\u043d\u0438 \u0435\u0432\u0440\u043e\u043f\u0435\u0439\u0441\u043a\u0438\u0445 \u0434\u043e\u043d\u043e\u0440\u043e\u0432, \u043f\u044b\u0442\u0430\u044f\u0441\u044c \u0437\u0430\u0440\u0430\u0437\u0438\u0442\u044c \u043a\u043e\u043c\u043f\u044c\u044e\u0442\u0435\u0440\u044b \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u0439 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043e\u0439. \u041f\u043e\u043b\u043d\u043e\u0439 \u0443\u0432\u0435\u0440\u0435\u043d\u043d\u043e\u0441\u0442\u0438, \u0447\u0442\u043e \u044d\u0442\u043e \u0438\u043c\u0435\u043d\u043d\u043e Cold River, \u0443 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 \u043d\u0435\u0442, \u043d\u043e \u0442\u0435\u0445\u043d\u0438\u043a\u0438 \u0441\u043e\u0432\u043f\u0430\u0434\u0430\u044e\u0442 \u043f\u043e\u0447\u0442\u0438 \u043e\u0434\u0438\u043d \u0432 \u043e\u0434\u0438\u043d. \u0420\u0430\u0441\u0441\u043a\u0430\u0437\u044b\u0432\u0430\u0435\u043c, \u0447\u0442\u043e \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0438\u043b\u0430 \u043a\u043e\u043c\u0430\u043d\u0434\u0430 RESIDENT.NGO \u0438 \u0447\u0442\u043e \u0434\u0435\u043b\u0430\u0442\u044c, \u0435\u0441\u043b\u0438 \u043f\u043e\u0445\u043e\u0436\u0435\u0435 \u043f\u0438\u0441\u044c\u043c\u043e \u043f\u043e\u043b\u0443\u0447\u0438\u0442 \u043a\u0442\u043e-\u0442\u043e \u0438\u0437 \u043d\u0430\u0448\u0435\u0433\u043e \u043a\u0440\u0443\u0433\u0430.<\/p>\n<!-- \/wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>\u0427\u0442\u043e \u0434\u0435\u043b\u0430\u0442\u044c, \u0435\u0441\u043b\u0438 \u043f\u0440\u0438\u0448\u043b\u043e \u043f\u043e\u0434\u043e\u0437\u0440\u0438\u0442\u0435\u043b\u044c\u043d\u043e\u0435 \u043f\u0438\u0441\u044c\u043c\u043e<\/strong><\/p>\n<!-- \/wp:paragraph -->\n\n<!-- wp:list -->\n<ul class=\"wp-block-list\"><!-- wp:list-item -->\n<li>\u041d\u0438 \u043e\u0434\u0438\u043d \u043d\u0430\u0441\u0442\u043e\u044f\u0449\u0438\u0439 \u0434\u043e\u043d\u043e\u0440 \u043d\u0435 \u043f\u0440\u0438\u0441\u044b\u043b\u0430\u0435\u0442 \u043f\u0440\u0435\u0434\u043b\u043e\u0436\u0435\u043d\u0438\u044f \u0438\u043b\u0438 \u043f\u0440\u0438\u0433\u043b\u0430\u0448\u0435\u043d\u0438\u044f \u0432 \u0432\u0438\u0434\u0435 \u0444\u0430\u0439\u043b\u0430 \u0432\u0438\u0440\u0442\u0443\u0430\u043b\u044c\u043d\u043e\u0433\u043e \u0434\u0438\u0441\u043a\u0430 (\u0440\u0430\u0441\u0448\u0438\u0440\u0435\u043d\u0438\u044f .vhdx, .iso, .img) \u0438\u043b\u0438 \u0430\u0440\u0445\u0438\u0432\u0430 \u0441 \u043f\u0430\u0440\u043e\u043b\u0435\u043c, \u0443\u043a\u0430\u0437\u0430\u043d\u043d\u044b\u043c \u043f\u0440\u044f\u043c\u043e \u0432 \u043f\u0438\u0441\u044c\u043c\u0435. \u042d\u0442\u043e \u0441\u0430\u043c\u043e \u043f\u043e \u0441\u0435\u0431\u0435 \u043f\u0440\u0438\u0437\u043d\u0430\u043a \u0430\u0442\u0430\u043a\u0438, \u043d\u0435 \u043e\u0442\u043a\u0440\u044b\u0432\u0430\u0439\u0442\u0435 \u0442\u0430\u043a\u043e\u0439 \u0444\u0430\u0439\u043b.<\/li>\n<!-- \/wp:list-item -->\n\n<!-- wp:list-item -->\n<li>\u0415\u0441\u043b\u0438 \u043f\u0440\u0435\u0434\u043b\u043e\u0436\u0435\u043d\u0438\u0435 \u0438\u043b\u0438 \u043f\u0440\u0438\u0433\u043b\u0430\u0448\u0435\u043d\u0438\u0435 \u043f\u0440\u0438\u0448\u043b\u043e \u043d\u0435\u043e\u0436\u0438\u0434\u0430\u043d\u043d\u043e, \u043f\u0440\u0435\u0436\u0434\u0435 \u0447\u0435\u043c \u043e\u0442\u0432\u0435\u0447\u0430\u0442\u044c \u0438\u043b\u0438 \u043e\u0442\u043a\u0440\u044b\u0432\u0430\u0442\u044c \u0432\u043b\u043e\u0436\u0435\u043d\u0438\u0435, \u043f\u0440\u043e\u0432\u0435\u0440\u044c\u0442\u0435 \u0435\u0433\u043e \u0447\u0435\u0440\u0435\u0437 \u0443\u0436\u0435 \u0438\u0437\u0432\u0435\u0441\u0442\u043d\u044b\u0439 \u0432\u0430\u043c \u043a\u0430\u043d\u0430\u043b \u0441\u0432\u044f\u0437\u0438 (\u043d\u0430\u043f\u0440\u0438\u043c\u0435\u0440, \u043f\u043e\u0437\u0432\u043e\u043d\u0438\u0442\u0435 \u0432 \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u044e \u043d\u0430\u043f\u0440\u044f\u043c\u0443\u044e).<\/li>\n<!-- \/wp:list-item -->\n\n<!-- wp:list-item -->\n<li>\u0415\u0441\u043b\u0438 \u043f\u043e\u0434\u043e\u0437\u0440\u0438\u0442\u0435\u043b\u044c\u043d\u044b\u0439 \u0444\u0430\u0439\u043b \u0432\u0441\u0451 \u0436\u0435 \u0431\u044b\u043b \u043e\u0442\u043a\u0440\u044b\u0442 \u043d\u0430 \u043a\u043e\u043c\u043f\u044c\u044e\u0442\u0435\u0440\u0435 \u0441 Windows, \u0441\u0440\u0430\u0437\u0443 \u043e\u0442\u043a\u043b\u044e\u0447\u0438\u0442\u0435 \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u043e \u043e\u0442 \u0441\u0435\u0442\u0438 (\u0432\u044b\u043a\u043b\u044e\u0447\u0438\u0442\u0435 Wi-Fi\/\u043a\u0430\u0431\u0435\u043b\u044c) \u0438 \u043e\u0431\u0440\u0430\u0442\u0438\u0442\u0435\u0441\u044c \u043a \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u0438\u0441\u0442\u0443 \u043f\u043e \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438.<\/li>\n<!-- \/wp:list-item --><\/ul>\n<!-- \/wp:list -->\n\n<!-- wp:paragraph -->\n<p><strong>\u0427\u0442\u043e \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0438\u043b\u0430 \u043a\u043e\u043c\u0430\u043d\u0434\u0430 RESIDENT.NGO<\/strong><\/p>\n<!-- \/wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>\u0421\u043d\u0430\u0447\u0430\u043b\u0430 \u043f\u0440\u0438\u0445\u043e\u0434\u0438\u0442 \u043e\u0431\u044b\u0447\u043d\u043e\u0435, \u0434\u0440\u0443\u0436\u0435\u043b\u044e\u0431\u043d\u043e\u0435 \u043f\u0438\u0441\u044c\u043c\u043e: \u043f\u0440\u0438\u0433\u043b\u0430\u0448\u0435\u043d\u0438\u0435 \u043d\u0430 \u043a\u043e\u043d\u0444\u0435\u0440\u0435\u043d\u0446\u0438\u044e \u0438\u043b\u0438 \u043f\u0440\u0435\u0434\u043b\u043e\u0436\u0435\u043d\u0438\u0435 \u0433\u0440\u0430\u043d\u0442\u0430 \u043e\u0442 \u0438\u043c\u0435\u043d\u0438 \u043d\u0430\u0441\u0442\u043e\u044f\u0449\u0435\u0439, \u0438\u0437\u0432\u0435\u0441\u0442\u043d\u043e\u0439 \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0438 (\u0432 \u044d\u0442\u043e\u043c \u0441\u043b\u0443\u0447\u0430\u0435 \u043e\u0442 \u0438\u043c\u0435\u043d\u0438 European Business Summits, European Endowment for Democracy \u0438 East Europe Foundation Moldova). \u0418\u043c\u044f \u043e\u0442\u043f\u0440\u0430\u0432\u0438\u0442\u0435\u043b\u044f \u0437\u043d\u0430\u043a\u043e\u043c\u043e\u0435, \u043d\u043e \u0430\u0434\u0440\u0435\u0441 \u044d\u043b\u0435\u043a\u0442\u0440\u043e\u043d\u043d\u043e\u0439 \u043f\u043e\u0447\u0442\u044b \u043f\u043e\u0434\u0434\u0435\u043b\u044c\u043d\u044b\u0439.<\/p>\n<!-- \/wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>\u0415\u0441\u043b\u0438 \u0447\u0435\u043b\u043e\u0432\u0435\u043a \u043e\u0442\u0432\u0435\u0447\u0430\u0435\u0442 \u0438 \u043f\u0440\u043e\u044f\u0432\u043b\u044f\u0435\u0442 \u0438\u043d\u0442\u0435\u0440\u0435\u0441, \u0435\u043c\u0443 \u043f\u0440\u0438\u0441\u044b\u043b\u0430\u044e\u0442 \u0430\u0440\u0445\u0438\u0432 \u0441 \u043f\u0430\u0440\u043e\u043b\u0435\u043c (\u043f\u0430\u0440\u043e\u043b\u044c \u0443\u043a\u0430\u0437\u0430\u043d \u0432 \u0441\u0430\u043c\u043e\u043c \u043f\u0438\u0441\u044c\u043c\u0435). \u0412\u043d\u0443\u0442\u0440\u0438 \u043d\u0435 \u043e\u0431\u044b\u0447\u043d\u044b\u0439 \u0434\u043e\u043a\u0443\u043c\u0435\u043d\u0442, \u0430 \u0444\u0430\u0439\u043b \u0432\u0438\u0440\u0442\u0443\u0430\u043b\u044c\u043d\u043e\u0433\u043e \u0434\u0438\u0441\u043a\u0430. \u0415\u0441\u043b\u0438 \u0435\u0433\u043e \u043e\u0442\u043a\u0440\u044b\u0442\u044c, \u043d\u0430 \u044d\u043a\u0440\u0430\u043d\u0435 \u043f\u043e\u044f\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u043f\u0440\u0430\u0432\u0434\u043e\u043f\u043e\u0434\u043e\u0431\u043d\u044b\u0439 PDF-\u0444\u0430\u0439\u043b \u0441 \u043f\u0440\u0435\u0434\u043b\u043e\u0436\u0435\u043d\u0438\u0435\u043c, \u0430 \u0432 \u044d\u0442\u043e \u0432\u0440\u0435\u043c\u044f \u0432 \u0444\u043e\u043d\u0435 \u043d\u0435\u0437\u0430\u043c\u0435\u0442\u043d\u043e \u0443\u0441\u0442\u0430\u043d\u0430\u0432\u043b\u0438\u0432\u0430\u0435\u0442\u0441\u044f \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u0430\u044f \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u0430: \u043e\u043d\u0430 \u0441\u0432\u044f\u0437\u044b\u0432\u0430\u0435\u0442\u0441\u044f \u0441 \u0441\u0435\u0440\u0432\u0435\u0440\u043e\u043c \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u043e\u0432 \u0438 \u043c\u043e\u0436\u0435\u0442 \u0432 \u043b\u044e\u0431\u043e\u0439 \u043c\u043e\u043c\u0435\u043d\u0442 \u0437\u0430\u0433\u0440\u0443\u0437\u0438\u0442\u044c \u0434\u043e\u043f\u043e\u043b\u043d\u0438\u0442\u0435\u043b\u044c\u043d\u044b\u0435 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0435 \u043c\u043e\u0434\u0443\u043b\u0438.<\/p>\n<!-- \/wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>\u041e\u0441\u043e\u0431\u0435\u043d\u043d\u043e \u043a\u043e\u0432\u0430\u0440\u043d\u043e \u0442\u043e, \u0447\u0442\u043e \u043e\u0431\u044b\u0447\u043d\u043e\u0435 \u043f\u0440\u0435\u0434\u0443\u043f\u0440\u0435\u0436\u0434\u0435\u043d\u0438\u0435 Windows \u043e \u0444\u0430\u0439\u043b\u0430\u0445, \u0441\u043a\u0430\u0447\u0430\u043d\u043d\u044b\u0445 \u0438\u0437 \u0438\u043d\u0442\u0435\u0440\u043d\u0435\u0442\u0430, \u0432 \u044d\u0442\u043e\u043c \u0441\u043b\u0443\u0447\u0430\u0435 \u043c\u043e\u0436\u0435\u0442 \u043d\u0435 \u0441\u0440\u0430\u0431\u043e\u0442\u0430\u0442\u044c, \u0442\u043e \u0435\u0441\u0442\u044c \u043d\u0438\u0447\u0435\u0433\u043e \u043f\u043e\u0434\u043e\u0437\u0440\u0438\u0442\u0435\u043b\u044c\u043d\u043e\u0433\u043e \u0432\u0438\u0437\u0443\u0430\u043b\u044c\u043d\u043e \u043d\u0435 \u0432\u0438\u0434\u043d\u043e.<\/p>\n<!-- \/wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>\u041f\u043e\u0447\u0438\u0442\u0430\u0442\u044c \u043f\u043e\u0434\u0440\u043e\u0431\u043d\u0435\u0435<\/strong><\/p>\n<!-- \/wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>\u041f\u043e\u043b\u043d\u044b\u0439 \u0442\u0435\u0445\u043d\u0438\u0447\u0435\u0441\u043a\u0438\u0439 \u0440\u0430\u0437\u0431\u043e\u0440 \u043a\u043e\u043c\u0430\u043d\u0434\u044b RESIDENT.NGO, \u0441 \u0434\u0435\u0442\u0430\u043b\u044f\u043c\u0438 \u0430\u0442\u0430\u043a\u0438, \u0438\u043d\u0434\u0438\u043a\u0430\u0442\u043e\u0440\u0430\u043c\u0438 \u0437\u0430\u0440\u0430\u0436\u0435\u043d\u0438\u044f \u0438 \u0441\u043a\u0440\u0438\u043d\u0448\u043e\u0442\u0430\u043c\u0438, \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d \u043d\u0430 \u0438\u0445 \u0441\u0430\u0439\u0442\u0435:<br>\ud83d\udc49 <a href=\"https:\/\/resident.ngo\/lab\/writeups\/malware-campaign-impersonates-european-donors-to-target-moldovan-media-and-civil-society\/\">resident.ngo\/lab\/writeups\/malware-campaign-impersonates-european-donors-to-target-moldovan-media-and-civil-society<\/a><\/p>\n<!-- \/wp:paragraph -->","_ru_post_name":"moldova-civil-society-media-cyberattack-cold-river","_ru_post_excerpt":"","_ru_post_title":"\u0412\u043d\u0438\u043c\u0430\u043d\u0438\u0435: \u0430\u0442\u0430\u043a\u0430 \u043d\u0430 \u043c\u043e\u043b\u0434\u0430\u0432\u0441\u043a\u0438\u0435 \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0438 \u0433\u0440\u0430\u0436\u0434\u0430\u043d\u0441\u043a\u043e\u0433\u043e \u043e\u0431\u0449\u0435\u0441\u0442\u0432\u0430 \u0438 \u043c\u0435\u0434\u0438\u0430, \u043f\u043e\u0445\u043e\u0436\u0430\u044f \u043d\u0430 \u043f\u043e\u0447\u0435\u0440\u043a Cold River","_en_post_content":"<!-- wp:image {\"id\":2512,\"sizeSlug\":\"large\",\"linkDestination\":\"none\"} -->\n<figure class=\"wp-block-image size-large\"><img src=\"https:\/\/digitalskills.lt\/wp-content\/uploads\/2026\/10\/image-2-1024x342.png\" alt=\"\" class=\"wp-image-2512\"\/><\/figure>\n<!-- \/wp:image -->\n\n<!-- wp:paragraph -->\n<p>The Digital Skills Coalition Belarus team wants to flag a finding from our colleagues at RESIDENT.NGO.<\/p>\n<!-- \/wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Cold River (also known as Star Blizzard), a hacking group linked to Russian state security services, has for years been known for attacking journalists, NGOs, and activists through fake emails impersonating familiar organizations. The RESIDENT.NGO team uncovered a campaign that closely resembles their tactics: in September 2026, attackers sent Moldovan media outlets and civil society organizations emails impersonating European donors, attempting to infect computers with malware. Researchers aren't fully certain this is Cold River, but the techniques match almost exactly. Here's what RESIDENT.NGO found and what to do if someone in our circle receives a similar email.<\/p>\n<!-- \/wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>What to do if you receive a suspicious email<\/strong><\/p>\n<!-- \/wp:paragraph -->\n\n<!-- wp:list -->\n<ul class=\"wp-block-list\"><!-- wp:list-item -->\n<li>A legitimate donor never sends a proposal or invitation as a virtual disk file (.vhdx, .iso, .img extensions) or as a password-protected archive with the password written in the same email. This alone is a sign of an attack, don't open such a file.<\/li>\n<!-- \/wp:list-item -->\n\n<!-- wp:list-item -->\n<li>If an offer or invitation is unexpected, verify it through a channel you already know (for example, call the organization directly) before replying or opening anything.<\/li>\n<!-- \/wp:list-item -->\n\n<!-- wp:list-item -->\n<li>If a suspicious file has already been opened on a Windows computer, disconnect the device from the network immediately (turn off Wi-Fi\/unplug the cable) and contact a security specialist.<\/li>\n<!-- \/wp:list-item --><\/ul>\n<!-- \/wp:list -->\n\n<!-- wp:paragraph -->\n<p><strong>What RESIDENT.NGO found<\/strong><\/p>\n<!-- \/wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>It starts with an ordinary, friendly email: an invitation to a conference or a grant offer in the name of a real, well-known organization (in this case, European Business Summits, the European Endowment for Democracy, and East Europe Foundation Moldova). The sender's name is familiar, but the email address is fake.<\/p>\n<!-- \/wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>If the person replies and shows interest, they're sent a password-protected archive (the password is given in the email itself). Inside is not an ordinary document but a virtual disk image file. Opening it shows a convincing PDF with the proposal, while in the background a malicious program is quietly installed: it contacts the attacker's server and can download additional malicious modules at any time.<\/p>\n<!-- \/wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>What makes this especially sneaky is that Windows' usual warning about files downloaded from the internet may not trigger in this case, so nothing looks suspicious at a glance.<\/p>\n<!-- \/wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Read more<\/strong><\/p>\n<!-- \/wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The full technical report from RESIDENT.NGO, with attack details, indicators of compromise, and screenshots, is published on their site:<br>\ud83d\udc49 <a href=\"https:\/\/resident.ngo\/lab\/writeups\/malware-campaign-impersonates-european-donors-to-target-moldovan-media-and-civil-society\/\">resident.ngo\/lab\/writeups\/malware-campaign-impersonates-european-donors-to-target-moldovan-media-and-civil-society<\/a><\/p>\n<!-- \/wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><\/p>\n<!-- \/wp:paragraph -->","_en_post_name":"","_en_post_excerpt":"","_en_post_title":"Alert: Attack on Moldovan Civil Society and Media Organizations, Resembling Cold River's Tactics","edit_language":"en","_jetpack_newsletter_access":"","_jetpack_dont_email_post_to_subs":false,"_jetpack_newsletter_tier_id":0,"_jetpack_memberships_contains_paywalled_content":false,"_jetpack_feature_clip_id":0,"_jetpack_memberships_contains_paid_content":false,"footnotes":"","jetpack_publicize_message":"","jetpack_publicize_feature_enabled":true,"jetpack_social_post_already_shared":false,"jetpack_social_options":{"image_generator_settings":{"template":"highway","default_image_id":0,"font":"","enabled":false},"version":2},"jetpack_post_was_ever_published":false},"categories":[30,29],"tags":[239,305,307,253,298,308,309,306,276,302,310,314,221,312,311,315,313],"class_list":["post-2509","post","type-post","status-publish","format-standard","has-post-thumbnail","","category-slider","category-news","tag-civil-society","tag-cold-river","tag-cyberattack","tag-cybersecurity","tag-digital-skills-coalition-belarus","tag-malware","tag-media","tag-moldova","tag-ngos","tag-phishing","tag-resident-ngo","tag-vredonosnoe-po","tag-grazhdanskoe-obshhestvo","tag-kiberataka","tag-kiberbezopasnost","tag-smi","tag-fishing"],"author_meta":{"display_name":"brolodeluxer","author_link":"https:\/\/digitalskills.lt\/en\/author\/robodeluxer\/"},"featured_img":"https:\/\/digitalskills.lt\/wp-content\/uploads\/2026\/10\/Screenshot-2026-10-05-at-14.23.52-900x475.png","jetpack_publicize_connections":[],"coauthors":[],"tax_additional":{"categories":{"linked":["<a href=\"https:\/\/digitalskills.lt\/en\/category\/slider\/\" class=\"advgb-post-tax-term\">Important<\/a>","<a href=\"https:\/\/digitalskills.lt\/en\/category\/news\/\" class=\"advgb-post-tax-term\">News<\/a>"],"unlinked":["<span class=\"advgb-post-tax-term\">Important<\/span>","<span class=\"advgb-post-tax-term\">News<\/span>"]},"tags":{"linked":["<a href=\"https:\/\/digitalskills.lt\/en\/category\/news\/\" class=\"advgb-post-tax-term\">civil-society<\/a>","<a href=\"https:\/\/digitalskills.lt\/en\/category\/news\/\" class=\"advgb-post-tax-term\">Cold River<\/a>","<a href=\"https:\/\/digitalskills.lt\/en\/category\/news\/\" class=\"advgb-post-tax-term\">cyberattack<\/a>","<a href=\"https:\/\/digitalskills.lt\/en\/category\/news\/\" class=\"advgb-post-tax-term\">cybersecurity<\/a>","<a href=\"https:\/\/digitalskills.lt\/en\/category\/news\/\" class=\"advgb-post-tax-term\">Digital Skills Coalition Belarus<\/a>","<a href=\"https:\/\/digitalskills.lt\/en\/category\/news\/\" class=\"advgb-post-tax-term\">malware<\/a>","<a href=\"https:\/\/digitalskills.lt\/en\/category\/news\/\" class=\"advgb-post-tax-term\">media<\/a>","<a href=\"https:\/\/digitalskills.lt\/en\/category\/news\/\" class=\"advgb-post-tax-term\">Moldova<\/a>","<a href=\"https:\/\/digitalskills.lt\/en\/category\/news\/\" class=\"advgb-post-tax-term\">ngos<\/a>","<a href=\"https:\/\/digitalskills.lt\/en\/category\/news\/\" class=\"advgb-post-tax-term\">phishing<\/a>","<a href=\"https:\/\/digitalskills.lt\/en\/category\/news\/\" class=\"advgb-post-tax-term\">resident.ngo<\/a>","<a href=\"https:\/\/digitalskills.lt\/en\/category\/news\/\" class=\"advgb-post-tax-term\">\u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u0435 \u041f\u041e<\/a>","<a href=\"https:\/\/digitalskills.lt\/en\/category\/news\/\" class=\"advgb-post-tax-term\">\u0433\u0440\u0430\u0436\u0434\u0430\u043d\u0441\u043a\u043e\u0435 \u043e\u0431\u0449\u0435\u0441\u0442\u0432\u043e<\/a>","<a href=\"https:\/\/digitalskills.lt\/en\/category\/news\/\" class=\"advgb-post-tax-term\">\u043a\u0438\u0431\u0435\u0440\u0430\u0442\u0430\u043a\u0430<\/a>","<a href=\"https:\/\/digitalskills.lt\/en\/category\/news\/\" class=\"advgb-post-tax-term\">\u043a\u0438\u0431\u0435\u0440\u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u044c<\/a>","<a href=\"https:\/\/digitalskills.lt\/en\/category\/news\/\" class=\"advgb-post-tax-term\">\u0421\u041c\u0418<\/a>","<a href=\"https:\/\/digitalskills.lt\/en\/category\/news\/\" class=\"advgb-post-tax-term\">\u0444\u0438\u0448\u0438\u043d\u0433<\/a>"],"unlinked":["<span class=\"advgb-post-tax-term\">civil-society<\/span>","<span class=\"advgb-post-tax-term\">Cold River<\/span>","<span class=\"advgb-post-tax-term\">cyberattack<\/span>","<span class=\"advgb-post-tax-term\">cybersecurity<\/span>","<span class=\"advgb-post-tax-term\">Digital Skills Coalition Belarus<\/span>","<span class=\"advgb-post-tax-term\">malware<\/span>","<span class=\"advgb-post-tax-term\">media<\/span>","<span class=\"advgb-post-tax-term\">Moldova<\/span>","<span class=\"advgb-post-tax-term\">ngos<\/span>","<span class=\"advgb-post-tax-term\">phishing<\/span>","<span class=\"advgb-post-tax-term\">resident.ngo<\/span>","<span class=\"advgb-post-tax-term\">\u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u0435 \u041f\u041e<\/span>","<span class=\"advgb-post-tax-term\">\u0433\u0440\u0430\u0436\u0434\u0430\u043d\u0441\u043a\u043e\u0435 \u043e\u0431\u0449\u0435\u0441\u0442\u0432\u043e<\/span>","<span class=\"advgb-post-tax-term\">\u043a\u0438\u0431\u0435\u0440\u0430\u0442\u0430\u043a\u0430<\/span>","<span class=\"advgb-post-tax-term\">\u043a\u0438\u0431\u0435\u0440\u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u044c<\/span>","<span class=\"advgb-post-tax-term\">\u0421\u041c\u0418<\/span>","<span class=\"advgb-post-tax-term\">\u0444\u0438\u0448\u0438\u043d\u0433<\/span>"]}},"comment_count":0,"relative_dates":{"created":"Posted 2 hours ago","modified":"Updated 1 hour ago"},"absolute_dates":{"created":"Posted on 05.10.2026","modified":"Updated on 05.10.2026"},"absolute_dates_time":{"created":"Posted on 05.10.2026 14:16","modified":"Updated on 05.10.2026 14:29"},"featured_img_caption":"    \u041a\u0430\u043c\u043f\u0430\u043d\u0438\u044f \u043f\u0440\u043e\u0442\u0438\u0432 \u043c\u043e\u043b\u0434\u0430\u0432\u0441\u043a\u0438\u0445 \u0421\u041c\u0418 \u0438 \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0439 \u0433\u0440\u0430\u0436\u0434\u0430\u043d\u0441\u043a\u043e\u0433\u043e \u043e\u0431\u0449\u0435\u0441\u0442\u0432\u0430 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u0442 \u0444\u0438\u0448\u0438\u043d\u0433\u043e\u0432\u044b\u0435 \u043f\u0438\u0441\u044c\u043c\u0430 \u0438 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0435 \u0432\u043b\u043e\u0436\u0435\u043d\u0438\u044f. \u0425\u0430\u0440\u0430\u043a\u0442\u0435\u0440 \u0430\u0442\u0430\u043a\u0438 \u0438\u043c\u0435\u0435\u0442 \u0441\u0445\u043e\u0434\u0441\u0442\u0432\u043e \u0441 \u0438\u0437\u0432\u0435\u0441\u0442\u043d\u044b\u043c\u0438 \u043e\u043f\u0435\u0440\u0430\u0446\u0438\u044f\u043c\u0438 Cold River.","series_order":"","jetpack_sharing_enabled":true,"jetpack_likes_enabled":true,"jetpack_featured_media_url":"https:\/\/digitalskills.lt\/wp-content\/uploads\/2026\/10\/Screenshot-2026-10-05-at-14.23.52.png","_links":{"self":[{"href":"https:\/\/digitalskills.lt\/en\/wp-json\/wp\/v2\/posts\/2509","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/digitalskills.lt\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/digitalskills.lt\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/digitalskills.lt\/en\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/digitalskills.lt\/en\/wp-json\/wp\/v2\/comments?post=2509"}],"version-history":[{"count":1,"href":"https:\/\/digitalskills.lt\/en\/wp-json\/wp\/v2\/posts\/2509\/revisions"}],"predecessor-version":[{"id":2513,"href":"https:\/\/digitalskills.lt\/en\/wp-json\/wp\/v2\/posts\/2509\/revisions\/2513"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/digitalskills.lt\/en\/wp-json\/wp\/v2\/media\/2514"}],"wp:attachment":[{"href":"https:\/\/digitalskills.lt\/en\/wp-json\/wp\/v2\/media?parent=2509"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/digitalskills.lt\/en\/wp-json\/wp\/v2\/categories?post=2509"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/digitalskills.lt\/en\/wp-json\/wp\/v2\/tags?post=2509"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}