Bluecharlie

BlueCharlie, also known as TAG-53, Blue Callisto, Callisto (or Calisto), COLDRIVER, Star Blizzard (formerly SEABORGIUM), and TA446, is a threat actor that has been linked to Russia and has reportedly been active since 2019. The group has been involved in various malicious activities including cyberespionage, cyber influence campaigns, and phishing attacks, primarily targeting sectors such as international affairs, defense, and logistics support to Ukraine. It has been identified by the Computer Weekly as an operation of the Russian Federal Security Service (FSB). In August, Insikt Group, a division of Recorded Future, reported that BlueCharlie was linked to 94 new domains, indicating that the group has been actively modifying its infrastructure in response to public disclosures about its activities. This evolution in tactics showcases the group's adaptability and persistence. The new infrastructure is likely to be used for phishing campaigns and/or credential harvesting, pointing towards an increase in their cybercriminal activities. The group utilizes cloud-based platforms like HubSpot, MailerLite, and virtual private servers (VPS) partnered with server-side scripts to prevent automated scanning. According to Zoey Selman, a threat intelligence analyst at Recorded Future's Insikt Group, this approach enables BlueCharlie to set allow parameters to redirect victims to threat actor infrastructure only when certain requirements are met. Recently, researchers observed the group using email marketing services to target think tanks and research organizations with the aim of obtaining credentials for a U.S. grants management portal.