Calisto

Threat Actor Profile Updated 24 days ago
Download STIX
Preview STIX
Calisto, also known as BlueCharlie, Blue Callisto, TAG-53, COLDRIVER, Star Blizzard (formerly SEABORGIUM), TA446, and UNC4057, is a threat actor that has been active since 2019. This group targets a wide range of sectors and is particularly focused on individuals and organizations involved in international affairs, defense, and logistics support to Ukraine. According to the Insikt Group, a Recorded Future threat research division, Calisto has been linked to 94 new domains since March this year, indicating an active modification of its infrastructure in response to public disclosures about its activities. Recorded Future has also identified this adversary as a contributor to Russian intelligence efforts, supporting Moscow's strategic interests. The cybersecurity firm noted that domain registration was one of the main skills used by this group, likely on behalf of Russian intelligence, either directly or through a contractor relationship. The group has been associated with cyberespionage, credential theft, and hack-and-leak operations aimed at Ukraine and NATO nations, amid increasing public disclosures regarding its activities. Despite these exposures, Calisto continues to evolve and establish new attack infrastructures. It has been observed that the group is persistently targeting entities related to Ukraine, disrupting Kiev's supply chain for military reinforcements. As such, continuous monitoring and mitigation strategies are crucial to counteract this persistent threat.
What's your take? (Question 1 of 4)
30e855bb-a3dc-4d16-a854-48ca5776c7e7 Help tune the shared Cybergeist dataset, assist your peers, and earn karma. Expand the panel to get started.
Possible Aliases / Cluster overlaps
It's hard to track cluster overlaps and naming conventions between vendors, so here are some possible overlapping names / profiles you also may want to look at.
IDVotesProfile Description
Bluecharlie
3
BlueCharlie, also known as TAG-53, Blue Callisto, Callisto (or Calisto), COLDRIVER, Star Blizzard (formerly SEABORGIUM), and TA446, is a threat actor that has been linked to Russia and has reportedly been active since 2019. The group has been involved in various malicious activities including cybere
COLDRIVER
2
Coldriver, also known as Star Blizzard and Callisto Group, is a Russian Advanced Persistent Threat (APT) actor that has been identified as a significant cybersecurity threat. Notably, Google's Threat Analysis Group (TAG) has issued warnings about Coldriver's use of a custom backdoor in its operation
Seaborgium
2
Seaborgium, also known as Star Blizzard, Callisto Group, and COLDRIVER, is a threat actor group linked to Russia's Federal Security Service (FSB), specifically its Center 18 cyberespionage unit. The group has been active since at least 2015, conducting extensive spear-phishing campaigns against Brit
TA446
2
TA446, also known as the Callisto APT group, Seaborgium, Star Blizzard, ColdRiver, TAG-53, and BlueCharlie, is a threat actor that has been active since at least 2015. This cyberespionage entity has persistently targeted individuals and organizations involved in international affairs, defense, and l
Miscellaneous Associations
Other elements of context that could aid in the identification of relevance
Blizzard
Associated Malware
To see the evidence that has resulted in this association, create a free account
IDTypeVotesProfile Description
No associations to display
Associated Threat Actors
To see the evidence that has resulted in this association, create a free account
IDTypeVotesProfile Description
No associations to display
Associated Vulnerabilities
To see the evidence that has resulted in this association, create a free account
IDTypeVotesProfile Description
No associations to display
Source Document References
Information about the Calisto Threat Actor was read from the documents corpus below. This display is limited to 20 results, create a free account to see more
SourceCreatedAtTitle
MITRE
a year ago
Calisto Trojan for macOS
CERT-EU
4 months ago
Russian COLDRIVER Hackers Expand Beyond Phishing with Custom Malware
CERT-EU
10 months ago
Russian Cyber Adversary BlueCharlie Alters Infrastructure in Response to Disclosures
CERT-EU
10 months ago
Novel attack infrastructure established by Russian hackers to bypass detection
CERT-EU
6 months ago
Microsoft Warns of COLDRIVER's Evolving Evading and Credential-Stealing Tactics
CERT-EU
10 months ago
Russian Cyber Adversary BlueCharlie Alters Infrastructure in Response to Disclosures – GIXtools
Securelist
6 months ago
Kaspersky Security Bulletin: APT predictions 2024
CERT-EU
6 months ago
Advanced threat predictions for 2024 – GIXtools
CERT-EU
5 months ago
Microsoft Alert: COLDRIVER Credential Theft Rising Again