Calisto

Threat Actor Profile Updated 3 months ago

Download STIX

Preview STIX

Calisto, also known as BlueCharlie, Blue Callisto, TAG-53, COLDRIVER, Star Blizzard (formerly SEABORGIUM), TA446, and UNC4057, is a threat actor that has been active since 2019. This group targets a wide range of sectors and is particularly focused on individuals and organizations involved in international affairs, defense, and logistics support to Ukraine. According to the Insikt Group, a Recorded Future threat research division, Calisto has been linked to 94 new domains since March this year, indicating an active modification of its infrastructure in response to public disclosures about its activities. Recorded Future has also identified this adversary as a contributor to Russian intelligence efforts, supporting Moscow's strategic interests. The cybersecurity firm noted that domain registration was one of the main skills used by this group, likely on behalf of Russian intelligence, either directly or through a contractor relationship. The group has been associated with cyberespionage, credential theft, and hack-and-leak operations aimed at Ukraine and NATO nations, amid increasing public disclosures regarding its activities. Despite these exposures, Calisto continues to evolve and establish new attack infrastructures. It has been observed that the group is persistently targeting entities related to Ukraine, disrupting Kiev's supply chain for military reinforcements. As such, continuous monitoring and mitigation strategies are crucial to counteract this persistent threat.

What's your take? (Question 1 of 5)

Help tune the shared Cybergeist dataset, assist your peers, and earn karma. Expand the panel to get started.

Possible Aliases / Cluster overlaps

It's hard to track cluster overlaps and naming conventions between vendors, so here are some possible overlapping names / profiles you also may want to look at.

ID	Votes	Profile Description
Bluecharlie	3	BlueCharlie, also known as TAG-53, Blue Callisto, Callisto (or Calisto), COLDRIVER, Star Blizzard (formerly SEABORGIUM), and TA446, is a threat actor that has been linked to Russia and has reportedly been active since 2019. The group has been involved in various malicious activities including cybere
COLDRIVER	2	Coldriver, also known as Callisto Group and Star Blizzard, is a threat actor believed to originate from Russia. This entity is recognized for its malicious activities including disinformation campaigns, spear-phishing attacks, and the use of custom malware. The group has been associated with the Rus
Seaborgium	2	Seaborgium, also known as Star Blizzard, Callisto Group, COLDRIVER, and TAG-53, is a threat actor linked to suspected Russian threat activity groups. Open-source reporting has enabled Insikt Group to profile the infrastructure used by this group, revealing significant overlaps with other known malic
TA446	2	TA446, also known as the Callisto APT group, Seaborgium, Star Blizzard, ColdRiver, TAG-53, and BlueCharlie, is a threat actor that has been active since at least 2015. This cyberespionage entity has persistently targeted individuals and organizations involved in international affairs, defense, and l
Callisto	1	Callisto, also known as Gossamer Bear, COLDRIVER, UNC4057, Star Blizzard, Blue Charlie, and SEABORGIUM, is a threat actor linked to the Russian state. This group, which has been tracked by various entities including Microsoft, Google's Threat Analysis Group (TAG), and Insikt Group, is known for its
Star Blizzard	1	Star Blizzard, also known as Seaborgium or the Callisto Group, is a threat actor linked to Russia's intelligence service, the FSB. The group has been involved in sophisticated cyber-attacks worldwide, primarily using spear-phishing campaigns to steal account credentials and data. Microsoft, which tr
Blue Callisto	1	Blue Callisto, also known as COLDRIVER, BlueCharlie (or TAG-53), Calisto, Gossamer Bear, Star Blizzard (formerly SEABORGIUM), TA446, and UNC4057, is a malicious software program that has been active since 2019. This malware is designed to infiltrate computer systems and devices, often undetected, vi
Gossamer Bear	1	Gossamer Bear, also known as Callisto, Blue Callisto, BlueCharlie (or TAG-53), Calisto, Star Blizzard (formerly SEABORGIUM), TA446, and UNC4057, is a significant threat actor that has been active since 2019. The group primarily focuses on credential harvesting and conducts hack-and-leak campaigns ta
Unc4057	1	UNC4057, also known as ColdRiver, Star Blizzard, Blue Charlie, and Callisto, is a Russian-backed advanced persistent threat (APT) group that has been active since 2019. This group, sponsored by the Federal Security Service (FSB), has been involved in various malicious activities on behalf of the Rus
Star Blizzard/seaborgium	1	None

Miscellaneous Associations

Other elements of context that could aid in the identification of relevance

Blizzard

Russia

Macos

Backdoor

Trojan

Antivirus

Associated Malware

To see the evidence that has resulted in this association, create a free account

ID	Type	Votes	Profile Description
Proton	Unspecified	1	Proton is a malicious software, or malware, that has been found to exploit and damage computer systems. It can infect systems through suspicious downloads, emails, or websites, often without the user's knowledge. Once inside, Proton has the capability to steal personal information, disrupt operation

Associated Threat Actors

To see the evidence that has resulted in this association, create a free account

ID	Type	Votes	Profile Description
No associations to display

Associated Vulnerabilities

To see the evidence that has resulted in this association, create a free account

ID	Type	Votes	Profile Description
No associations to display

Source Document References

Information about the Calisto Threat Actor was read from the documents corpus below. This display is limited to 20 results, create a free account to see more

Source	CreatedAt	Title
CERT-EU	6 months ago	Russian COLDRIVER Hackers Expand Beyond Phishing with Custom Malware
CERT-EU	8 months ago	Advanced threat predictions for 2024 – GIXtools
Securelist	8 months ago	Kaspersky Security Bulletin: APT predictions 2024
CERT-EU	7 months ago	Microsoft Alert: COLDRIVER Credential Theft Rising Again
CERT-EU	8 months ago	Microsoft Warns of COLDRIVER's Evolving Evading and Credential-Stealing Tactics
CERT-EU	a year ago	Novel attack infrastructure established by Russian hackers to bypass detection
CERT-EU	a year ago	Russian Cyber Adversary BlueCharlie Alters Infrastructure in Response to Disclosures – GIXtools
CERT-EU	a year ago	Russian Cyber Adversary BlueCharlie Alters Infrastructure in Response to Disclosures
MITRE	a year ago	Calisto Trojan for macOS