Callisto

Callisto, also known as Star Blizzard, COLDRIVER, TAG-53, and BlueCharlie, is a threat actor group likely based in Russia that has been linked to malicious cyber activities. The group is notorious for its sophisticated spear-phishing attacks targeting organizations and individuals in the UK and other areas of interest for information-gathering purposes. Insikt Group, leveraging open-source reporting, identified new infrastructure used by TAG-53, which shows significant overlap with Callisto Group, COLDRIVER, and SEABORGIUM. This consistent setup pattern suggests a strong connection between these entities. In December 2023, the U.S. Department of Justice announced charges against two Callisto-affiliated actors, Ruslan Aleksandrovich Peretyatko, an officer in FSB Center 18, and Andrey Stanislavovich Korinets. The Callisto Group targeted various entities, including U.S.-based companies, former and current employees of the U.S. Intelligence Community, Department of Defense and Department of State, U.S. military defense contractors, and Department of Energy staff. In response, Microsoft filed a civil action to seize 66 internet domains used by the Callisto Group, tracked by Microsoft Threat Intelligence as 'Star Blizzard'. Despite these actions, the Callisto Group remains active and continues to pose a significant cybersecurity threat. The group primarily uses phishing emails to steal login credentials and has recently developed a custom backdoor. In October 2024, a coordinated effort by the U.S. Department of Justice and Microsoft's Digital Crimes Unit disrupted a spear-phishing campaign orchestrated by Star Blizzard, resulting in the seizure of 107 internet domains linked to the group. However, this action is unlikely to end the group's spear-phishing activity, indicating the persistent threat posed by Callisto and affiliated groups.