IRON FRONTIER

Active since 2015, IRON FRONTIER is a Russian threat group that conducts targeted spearphishing against military and government organizations, journalists, and think tanks in Europe, the United States, and Russia's near abroad. IRON FRONTIER delivers phishing emails to potential victims using assumed identities of individuals likely familiar to the target and will actively engage in email exchanges to establish rapport. Victims are lead to credential harvesting sites run by IRON FRONTIER, who likely use the stolen credentials to gain access to sensitive email communications and documents.

On December 07, 2023, the UK government assessed that IRON FRONTIER is almost certainly operating on behalf of Russian Federal Security Service (FSB) Center 18 and sanctioned two IRON FRONTIER members for the 2018 intrusion into a UK-based pro-democracy think tank. Stolen documents were later leaked as part of a malign influence operation.