TA446

TA446, also known as the Callisto APT group, Seaborgium, Star Blizzard, ColdRiver, TAG-53, and BlueCharlie, is a significant threat actor that has been active since at least 2015. The group has persistently targeted government officials, military personnel, journalists, and think tanks, focusing on individuals and organizations involved in international affairs, defense, and logistics support to Ukraine. The group's activities have been tracked by both government and industry researchers, pointing to its widespread impact and high-level threats. In August, Insikt Group, a Recorded Future threat research division, reported that TA446 had been linked to 94 new domains since March of this year. This development suggests that the group is actively modifying its infrastructure in response to public disclosures about its activities. It demonstrates the group's adaptability and resilience in maintaining its operations despite increased scrutiny and exposure. The U.S. and UK governments have identified TA446 as being connected to Russia's Federal Security Service (FSB), specifically its Center 18 cyberespionage unit. This link was also corroborated by a report from Computer Weekly last year, which identified the hacking group as an FSB operation. This connection underscores the serious nature of the threat posed by TA446, as it indicates state-level resources and intent behind the group's malicious activities.