Seaborgium

Seaborgium, also known as Star Blizzard, Callisto Group, COLDRIVER, and TAG-53, is a threat actor linked to suspected Russian threat activity groups. Open-source reporting has enabled Insikt Group to profile the infrastructure used by this group, revealing significant overlaps with other known malicious entities. On August 15, 2022, a collaborative report by Microsoft, Google’s Threat Analysis Group (TAG), and Proofpoint’s Threat Research Team shed light on Seaborgium's ongoing phishing operations. This group has been active since at least 2015, targeting government officials, military personnel, journalists, and think tanks. The hacking group has been responsible for a nearly decade-long spear-phishing campaign against British lawmakers across multiple political parties and the leak of classified documents. Both Microsoft and the UK government have assessed that another entity, Blue Charlie, is linked to Seaborgium. The group has consistently set up its infrastructure in a way that bears significant similarities to those attributed to the Callisto Group, COLDRIVER, and SEABORGIUM, indicating a coordinated effort or shared resources among these entities. The US and UK governments have identified the Callisto Group, which is also known as Seaborgium, Coldriver, Star Blizzard, TA446, and TAG-53, as being linked to Russia’s Federal Security Service (FSB), specifically its Center 18 cyberespionage unit. Cybersecurity researchers at Microsoft's Threat Intelligence team have unveiled that this Russian state-sponsored actor has increased its sophistication and developed new evasion techniques to utilize in ongoing attacks. The group's successful email breaches enable it to carry out various malicious activities, highlighting the gravity of the situation.