Bluecharlie

Threat Actor Profile Updated 13 days ago
Download STIX
Preview STIX
BlueCharlie, also known as TAG-53, Blue Callisto, Callisto (or Calisto), COLDRIVER, Star Blizzard (formerly SEABORGIUM), and TA446, is a threat actor that has been linked to Russia and has reportedly been active since 2019. The group has been involved in various malicious activities including cyberespionage, cyber influence campaigns, and phishing attacks, primarily targeting sectors such as international affairs, defense, and logistics support to Ukraine. It has been identified by the Computer Weekly as an operation of the Russian Federal Security Service (FSB). In August, Insikt Group, a division of Recorded Future, reported that BlueCharlie was linked to 94 new domains, indicating that the group has been actively modifying its infrastructure in response to public disclosures about its activities. This evolution in tactics showcases the group's adaptability and persistence. The new infrastructure is likely to be used for phishing campaigns and/or credential harvesting, pointing towards an increase in their cybercriminal activities. The group utilizes cloud-based platforms like HubSpot, MailerLite, and virtual private servers (VPS) partnered with server-side scripts to prevent automated scanning. According to Zoey Selman, a threat intelligence analyst at Recorded Future's Insikt Group, this approach enables BlueCharlie to set allow parameters to redirect victims to threat actor infrastructure only when certain requirements are met. Recently, researchers observed the group using email marketing services to target think tanks and research organizations with the aim of obtaining credentials for a U.S. grants management portal.
What's your take? (Question 1 of 5)
Help tune the shared Cybergeist dataset, assist your peers, and earn karma. Expand the panel to get started.
Possible Aliases / Cluster overlaps
It's hard to track cluster overlaps and naming conventions between vendors, so here are some possible overlapping names / profiles you also may want to look at.
IDVotesProfile Description
COLDRIVER
5
Coldriver, also known as Star Blizzard and Callisto Group, is a Russian Advanced Persistent Threat (APT) actor that has been identified as a significant cybersecurity threat. Notably, Google's Threat Analysis Group (TAG) has issued warnings about Coldriver's use of a custom backdoor in its operation
Seaborgium
4
Seaborgium, also known as Star Blizzard, Callisto Group, and Coldriver, is a threat actor believed to be linked to Russia's Federal Security Service (FSB), specifically its Center 18 cyberespionage unit. The group has been active for nearly a decade, conducting spear-phishing campaigns against Briti
Calisto
3
Calisto, also known as BlueCharlie, Blue Callisto, TAG-53, COLDRIVER, Star Blizzard (formerly SEABORGIUM), TA446, and UNC4057, is a threat actor that has been active since 2019. This group targets a wide range of sectors and is particularly focused on individuals and organizations involved in intern
TA446
2
TA446, also known as the Callisto APT group, Seaborgium, Star Blizzard, ColdRiver, TAG-53, and BlueCharlie, is a threat actor that has been active since at least 2015. This cyberespionage entity has persistently targeted individuals and organizations involved in international affairs, defense, and l
Miscellaneous Associations
Other elements of context that could aid in the identification of relevance
Blizzard
Phishing
Espionage
Associated Malware
To see the evidence that has resulted in this association, create a free account
IDTypeVotesProfile Description
No associations to display
Associated Threat Actors
To see the evidence that has resulted in this association, create a free account
IDTypeVotesProfile Description
StarblizzardUnspecified
2
None
Associated Vulnerabilities
To see the evidence that has resulted in this association, create a free account
IDTypeVotesProfile Description
Blizzard/seaborgiumUnspecified
2
None
Star Blizzard/seaborgiumUnspecified
2
None
Source Document References
Information about the Bluecharlie Threat Actor was read from the documents corpus below. This display is limited to 20 results, create a free account to see more
SourceCreatedAtTitle
DARKReading
9 months ago
Russian APT 'BlueCharlie' Swaps Infrastructure to Evade Detection
CERT-EU
9 months ago
BlueCharlie changes attack infrastructure in response to reports on its activity
Recorded Future
9 months ago
BlueCharlie, Previously Tracked as TAG-53, Continues to Deploy New Infrastructure in 2023 | Recorded Future
CERT-EU
9 months ago
Russia-linked BlueCharlie APT evolves tactics as it adapts to public disclosures
CERT-EU
9 months ago
Russian Cyber Adversary BlueCharlie Alters Infrastructure in Response to Disclosures
DARKReading
5 months ago
Russia's 'Star Blizzard' APT Upgrades its Stealth, Only to Be Unmasked Again
CERT-EU
9 months ago
Novel attack infrastructure established by Russian hackers to bypass detection
CERT-EU
9 months ago
Cyber Security Week in Review: August 4, 2023
CERT-EU
9 months ago
Russian Cyber Adversary BlueCharlie Alters Infrastructure in Response to Disclosures – GIXtools
CERT-EU
5 months ago
Microsoft Warns of COLDRIVER's Evolving Evading and Credential-Stealing Tactics
CERT-EU
5 months ago
UK names Russian FSB agents behind political hacking campaign | #hacking | #cybersecurity | #infosec | #comptia | #pentest | #hacker | National Cyber Security Consulting
CERT-EU
5 months ago
US and British authorities sanction, indict Russian hackers
CERT-EU
5 months ago
US and British authorities sanction, indict Russian hackers | #hacking | #cybersecurity | #infosec | #comptia | #pentest | #hacker | National Cyber Security Consulting
Securelist
6 months ago
Kaspersky Security Bulletin: APT predictions 2024
CERT-EU
4 months ago
Russian COLDRIVER Hackers Expand Beyond Phishing with Custom Malware
CERT-EU
5 months ago
Microsoft Alert: COLDRIVER Credential Theft Rising Again
CERT-EU
5 months ago
UK accuses Russia of cyber interference targeting elections and democracy
CERT-EU
6 months ago
Advanced threat predictions for 2024 – GIXtools