Callisto Group

The Callisto Group, also known as 'Star Blizzard', 'SEABORGIUM', and 'COLDRIVER', is a threat actor linked to Russia's Federal Security Service (FSB), Center 18. This group has been involved in sophisticated spear-phishing campaigns aimed at unauthorized access and information theft from protected computers. Their targets have included U.S.-based companies, former and current employees of the U.S. Intelligence Community, Department of Defense, Department of State, military defense contractors, and Department of Energy staff. Among its members are Andrey Stanislavovich KORINETS, AKA Alexey DOGUZHIEV, and Ruslan Aleksandrovich PERETYATKO, a Russian FSB intelligence officer. In December 2023, the UK National Cyber Security Centre (NCSC) and Microsoft reported that the Callisto Group was targeting organizations worldwide. The U.S. Justice Department revealed the unsealing of a warrant to seize 41 domains used by this group for computer fraud in the United States. These domains were part of an ongoing spear-phishing campaign with the goal of gaining unauthorized access to, and stealing valuable information from, the computers and email accounts of U.S. government and other victims. In response to these threats, both Microsoft and the U.S. Department of Justice (DoJ) took significant action against the Callisto Group. Microsoft filed a civil action to seize 66 internet domains used by the group, while the U.S. DoJ seized over 100 domains used for launching attacks on U.S. government and nonprofits. These moves represent a concerted effort by international cybersecurity entities to counteract the malicious activities of the Callisto Group.