Recent research has revealed that Russian threat actors targeted several United States nuclear research laboratories in late summer 2022. The threat actors are tied to the Cold River (Callisto, TAG-53) organization, a Russian state-sponsored group known to commonly conduct cyberespionage operations. It is believed that affiliations between the threat group and the Russian state surfaced when data trails led back to an IT employee in Syktyvkar named Andrey Korinets. Several email addresses tied to Korinets were used in connection with Cold River operations between 2015 and 2020 alongside discussions on several Russian dark web forums. Between August and September of 2022, Cold River launched a social engineering campaign targeting nuclear scientists with fake login portals in an attempt to steal credentials. Specifically, threat actors mimicked copies of the Argonne, Brookhaven, and Livermore National Laboratories login pages and distributed them in their phishing emails. It has not been determined if any further compromise has occurred from this campaign or why these facilities were specifically targeted. Recent activity from the group shows that Cold River registered several domain names imitating non-governmental organizations investigating war crimes in the Russia/Ukraine conflict. CTIX will continue to monitor for any fallout from these campaigns and provide additional updates accordingly.