Nation-state APTEspionage
Cold River
Cold River is a Russia-attributed nation-state APT group with an espionage motive, tracked by Brandefense. It targets the Defense and Aerospace, and Civil Society and NGOs sectors in 5 countries, including the United States and India.
Also known as
- Nahr Elbard
- Nahr el bared
- Origin
- Russia
- Techniques
- 0
- Exploited CVEs
- No CVE data
- First seen
- Jan 1, 2019
- Record updated
Who They Target.
Sectors · 2
Countries · 5
About Cold River.
In short, “Cold River” is a sophisticated threat (actor) that utilizes DNS subdomain hijacking, certificate spoofing, and covert tunneled command and control traffic in combination with complex and convincing lure documents and custom implants.
Last updated Oct 9, 2026. Compiled by Brandefense technologies from structured threat intelligence and reviewed by Brandefense analysts. Techniques follow the MITRE ATT&CK framework.