Gossamer Bear

Gossamer Bear, also known as Callisto, Blue Callisto, BlueCharlie (or TAG-53), Calisto, Star Blizzard (formerly SEABORGIUM), TA446, and UNC4057, is a significant threat actor that has been active since 2019. The group primarily focuses on credential harvesting and conducts hack-and-leak campaigns targeting Ukraine and North Atlantic Treaty Organization (NATO) countries. Gossamer Bear has utilized compromised WordPress sites to impede attribution of their C2 servers, a tactic shared with other threat actors such as APT29 and Gamaredon. This group targets a wide range of sectors, including international affairs, defense, and logistics support to Ukraine. The report highlights the fact that Gossamer Bear, along with other actors like Frozenlake/Fancy Bear, Frozenvista, and the Belarusian actor Puschcha (UNC1151), have focused on specific types of attacks. While some groups prefer phishing campaigns against Ukraine and NATO countries, Gossamer Bear opts for more disruptive hack-and-leak campaigns, particularly against Ukraine and the UK. They are suspected of using pro-Russia media outlets to launder information acquired through collection operations, showcasing an alarming evolution in their tactics. In conclusion, Gossamer Bear represents a substantial cybersecurity threat due to its evolving tactics, persistent focus on key geopolitical regions, and its ability to impede attribution attempts. Their use of pro-Russia media outlets to disseminate acquired information further exacerbates the threat they pose. As this group continues to target individuals and organizations involved in international affairs, defense, and logistics support to Ukraine, it's crucial to stay vigilant and continually adapt defensive strategies to counter their evolving tactics.