LONDON, July 25 — The Cold River hacking campaign against fusion research ran from at least mid-2022 to March 2023, and the technical reality is that it was both persistent and precise. Mandiant’s 2023 M-Trends report logged over 150 targeted entities across the United Kingdom, the United States, and Europe. Spear-phishing emails linked to the group turned up in 18 NATO member states, with 74 percent of attacks concentrated in the energy and defence sectors.
That is not a scattergun approach; that is a strategic focus on high-value intellectual property.
Under the hood of the breach
The detail that matters, as ever, is what was actually taken. Microsoft’s Threat Intelligence Center (MSTIC) reported that Cold River compromised 25 high-value accounts at fusion organisations and exfiltrated an estimated 60 gigabytes of research data. That haul included reactor designs, experimental results, and personnel lists — the kind of material that represents years of public investment.
The average dwell time — the period the group remained unnoticed inside networks — was 146 days. That is noticeably longer than typical state-sponsored groups, a fact that suggests either stealth tradecraft or gaps in detection, possibly both.
The UK National Cyber Security Centre, in a joint advisory with the US Cybersecurity and Infrastructure Security Agency issued in May 2023, listed 44 unique indicators of compromise, including malicious domains and IP addresses. Those indicators give defenders something concrete to hunt for, but they come after the fact. As ever, the question is whether the initial entry could have been stopped earlier.
Indictment and attribution
The US Department of Justice indictment from March 2023 charges six GRU officers from Unit 26165 — the military intelligence unit notorious for previous email compromises — with attempting to hack into over 500 companies and government agencies worldwide between 2016 and 2022. Fusion targets were included among them. The indictment does not name every victim, but the pattern of targeting established by the campaign aligns with the unit’s known interests in energy research and defence technology.
The economic value of the stolen intellectual property is estimated at over $100 million by cybersecurity firm CrowdStrike. That figure is based on the potential cost of replicating fusion research from scratch, not on any actual sale of the data.
Fusion research is notoriously expensive and slow; losing proprietary designs can set back both public and private programmes by years.
The cost of cleanup
The response has been expensive. US and UK fusion facilities collectively spent an estimated $42 million on incident response and security upgrades after the breach, according to a 2023 report from the Government Accountability Office on cybersecurity at Department of Energy labs. That sum covers forensic investigations, network rebuilds, and the implementation of new access controls.
It does not include the long-term cost of intellectual property that can never be un-copied. What happens next is unclear.
The indictment charged individuals unlikely to face trial in a Western court. The IOCs have been shared. But the technical reality is that fusion research remains a high-value target for state actors willing to invest in long dwell times and careful phishing campaigns.
The detail that matters is that the average dwell time here was 146 days — and that is a number that ought to keep security teams watching the logs for a good while yet.
