In one of the incidents described in a UK government threat advisory published January 26, 2023, an attacker did not just send a poisoned link and wait for someone to click it. According to a report by the Iran-focused researchers at Certfa Lab, cited in the advisory, an operator working for a group tracked as TA453 joined a live video call with the target and pasted a malicious web address directly into the meeting’s chat window. The advisory lists this as one tactic among several, not as its centerpiece.
The document
The paper itself is titled “Advisory: SEABORGIUM and TA453 continue their respective spear-phishing campaigns against targets of interest.” It is marked Version 1, dated January 26, 2023, and carries Crown Copyright 2023, the standard copyright line the UK government puts on its official publications. The cover marks the document’s handling instructions as “TLP COLOUR,” a reference to the Traffic Light Protocol used across the industry to show how widely a report may be shared, with the actual color left as the unfilled word “COLOUR” rather than a specific shade. Whether that is a template left uncorrected or something else, the archived copy does not say.
The advisory was published by the UK’s National Cyber Security Centre (NCSC), part of GCHQ, the country’s signals intelligence agency; that attribution comes from the site hosting the document rather than from a line inside its own text. No division, analyst, or signing officer is named anywhere in the body. Readers who want to report similar activity are directed only to “NCSC reporting channels.” The document synthesizes earlier work from Microsoft’s Threat Intelligence Center (MSTIC), Google’s Threat Analysis Group (TAG), Certfa Lab, and Proofpoint, and maps its findings against MITRE ATT&CK, the shared reference catalog the cybersecurity industry uses to label hacking techniques with standardized codes.
Two campaigns, one year
Through 2022, the advisory states, two separate groups ran spear-phishing campaigns against overlapping kinds of targets: academics, defense-sector figures, government bodies, NGOs, think tanks, politicians, journalists, and activists, chiefly in the UK and other “areas of interest.” One, SEABORGIUM, is also tracked as Callisto Group, COLDRIVER, TA446, or TAG-53, and is linked to Russia; it has reportedly been active since at least 2017. The other, TA453, also known as APT42, Charming Kitten, Yellow Garuda, or ITG18, is linked to Iran.
Both, according to the advisory, used public social media and professional networking profiles to build convincing fake personas, often posing as credentialed experts. Both favored sending from ordinary webmail accounts, Outlook, Gmail, Yahoo, rather than anything obviously official, and both registered domains built to resemble legitimate organizations. Both preferred targets’ personal email addresses over work accounts, likely, the advisory notes, to sidestep corporate security controls. Both built rapport through long, unremarkable correspondence before sending anything malicious, and both used what the advisory calls multi-persona impersonation, two or more fake identities working the same thread to make the approach look more credible. Links went out by email, through documents hosted on OneDrive or Google Drive, or disguised as Zoom invitations, which is how the Certfa-documented call ended up with a hostile link in its chat window.
After the click
Once a target entered credentials on a spoofed sign-in page, the sequence that followed was, the advisory states, the same for both groups. They logged into the compromised mailbox, pulled correspondence and attachments, quietly set up forwarding rules to keep access going, and harvested contact lists to find new targets. Microsoft had already described this pattern in its own report on disrupting SEABORGIUM activity, published August 15, 2022. The NCSC advisory folds that account together with the separate Google, Certfa, and Proofpoint material into a single finding: two state-linked operations, with no declared connection to each other, running what reads as the same playbook.
The stated finding
The advisory’s own conclusion is plainly worded: spear-phishing is “an established technique used by many actors,” but SEABORGIUM and TA453 “continue to use it successfully and evolve the technique to maintain their success.” That is the document’s headline assessment, and it is a modest one. It is not a claim of some new or exotic method; it is a statement that an old method still works, and that both groups keep refining it.
“Not collaborating”
The advisory addresses the overlap between the two groups directly: “Although there is similarity in the TTPs [tactics, techniques, and procedures] and targeting profiles, these campaigns are separate and the two groups are not collaborating.” The document does not cite shared infrastructure, intercepted communications, or any other specific evidence for that separation; it states the conclusion without laying out what it was weighed against. One plain reading, offered here as this writer’s inference rather than the advisory’s own language, is that two unconnected state-linked operators arrived independently at similar methods because those methods work. The document itself does not say that, or anything else, about why the overlap exists.
What the advisory does not say
The gaps here are stated, not inferred. The advisory notes that the Microsoft indicator-of-compromise list it references “should not be considered exhaustive.” No victim, institution, or individual is named anywhere in the text. No count of compromised mailboxes appears. There is no attribution-confidence grading of the kind some threat reporting carries, and no mention of diplomatic protest, sanctions, or legal action tied to either campaign. The document describes technique. It does not describe casualties.
One version, no follow-up
The copy held in the National Security Archive’s Cyber Vault library is catalogued as item 173, dated January 26, 2023, and filed among records related to Ukraine. It is listed as Version 1. No addendum or Version 2 appears in that catalogue, and no later government statement, victim account, or news report tying a named target to this specific advisory has surfaced. No later version or follow-up has been published since.