Which sectors has COLDRIVER targeted?

Which sectors COLDRIVER tends to target

COLDRIVER is best understood as a threat actor that goes after sectors with intelligence value, not just any convenient victim. Its campaigns have focused on government, policy, security, journalism and civil society, which makes the selection pattern more about access to sensitive communications and influence-relevant material than about broad, indiscriminate intrusion.

That targeting profile matters because it shapes both the lure and the operational objective. In these sectors, successful compromise can expose correspondence, contacts, drafts, internal deliberations and account recovery paths, all of which can be valuable even when the attacker does not deploy noisy malware or destructive tradecraft.

The Threat Actor Groups Guide is useful background for interpreting COLDRIVER alongside the wider ecosystem of named clusters, aliases and campaign attribution. For defenders, the practical takeaway is that sector targeting often follows the value of the information environment, so a threat actor may repeatedly revisit the same communities when the intelligence payoff remains high.

Why those sectors are attractive to this threat pattern

Government and policy organisations often hold confidential deliberations, diplomatic material and strategic context that are useful for espionage or access brokering. Security teams are attractive because they may possess elevated visibility into incidents, investigations and defensive playbooks. Journalism and civil society groups can hold source material, unpublished reporting, advocacy plans and communications that reveal networks and timing.

That mix creates a common attacker objective: access to people and conversations rather than systems alone. When the target is a person who can forward, approve or contextualise sensitive information, credential theft becomes a force multiplier because one account can open a broader web of communications and secondary services.

NIST AI Risk Management Framework is not about this threat actor specifically, but its broader governance logic is relevant to organisations that need to understand where sensitive information flows and who can reach it. In practice, sectors that hold high-value correspondence should assume that phishing, impersonation and recovery-path abuse are part of the threat model, not edge cases.

What the targeting pattern means for defenders

Because the campaigns often centre on credential theft and access to communications, the first defensive priority is not chasing every sign of intrusion equally. It is deciding which accounts, inboxes and collaboration spaces would be most damaging if read, forwarded or used as a foothold into other services. That includes executives, spokespeople, researchers, administrators and anyone with access to sensitive casework or source relationships.

Defence should also account for the human layer of trust. People in these sectors are routinely contacted by unknown external parties, so impersonation attempts can blend into ordinary work unless identity verification is routine and phishing-resistant sign-in methods are widely used. Detection should focus on unusual sign-in behaviour, mailbox rules, forwarding changes, OAuth consent abuse and recovery-channel tampering.

NIST SP 800-63 Digital Identity Guidelines and NIST Cybersecurity Framework 2.0 both support the basic defensive pattern here: strengthen authentication, reduce account takeover paths, and make suspicious access easier to detect and respond to quickly. For this kind of target, account protection is a sector-specific resilience issue, not just an IT hygiene task.

Practitioner Guidance

What to prioritise: Start with the accounts and channels that would reveal the most sensitive conversations if compromised, then verify that those identities are covered by phishing-resistant authentication, strong recovery controls and alerting for impossible travel, new devices and forwarding-rule changes.

What to verify: Confirm that staff can recognise impersonation attempts aimed at source handling, policy engagement or incident response, and that the organisation can quickly review sign-in logs, mailbox activity and delegated-access changes when an alert fires.

Practitioner takeaway: For COLDRIVER-style targeting, the sector label matters less than the communication value of the victim set, so defenders should protect the few accounts whose compromise would expose the most sensitive relationships first.

Related resources from NHI Mgmt Group

• Which sectors has Scattered Lapsus$ Hunters targeted?
• Which sectors has Predatory Sparrow targeted?
• Which sectors has APT31 (Zirconium) targeted?
• Which sectors has NoName057(16) targeted?