Calisto

Calisto, also known as BlueCharlie, Blue Callisto, TAG-53, COLDRIVER, Star Blizzard (formerly SEABORGIUM), TA446, and UNC4057, is a threat actor that has been active since 2019. This group targets a wide range of sectors and is particularly focused on individuals and organizations involved in international affairs, defense, and logistics support to Ukraine. According to the Insikt Group, a Recorded Future threat research division, Calisto has been linked to 94 new domains since March this year, indicating an active modification of its infrastructure in response to public disclosures about its activities. Recorded Future has also identified this adversary as a contributor to Russian intelligence efforts, supporting Moscow's strategic interests. The cybersecurity firm noted that domain registration was one of the main skills used by this group, likely on behalf of Russian intelligence, either directly or through a contractor relationship. The group has been associated with cyberespionage, credential theft, and hack-and-leak operations aimed at Ukraine and NATO nations, amid increasing public disclosures regarding its activities. Despite these exposures, Calisto continues to evolve and establish new attack infrastructures. It has been observed that the group is persistently targeting entities related to Ukraine, disrupting Kiev's supply chain for military reinforcements. As such, continuous monitoring and mitigation strategies are crucial to counteract this persistent threat.