TA446

Threat Actor Profile Updated 3 months ago
Download STIX
Preview STIX
TA446, also known as the Callisto APT group, Seaborgium, Star Blizzard, ColdRiver, TAG-53, and BlueCharlie, is a threat actor that has been active since at least 2015. This cyberespionage entity has persistently targeted individuals and organizations involved in international affairs, defense, and logistics support to Ukraine. Their targets predominantly include government officials, military personnel, journalists, and think tanks. The group's activities have been tracked by both government and industry researchers, demonstrating its significant impact on cybersecurity. In August, Insikt Group, a Recorded Future threat research division, reported that TA446 was linked to 94 new domains starting from March this year. This suggests that the group is actively modifying its infrastructure in response to public disclosures about its activities. This continuous change in attack infrastructure signifies the group's adaptability and resilience against security measures and public exposure. The U.S. and UK governments have identified TA446 as being linked to Russia’s Federal Security Service (FSB), specifically its Center 18 cyberespionage unit. This association with a state-sponsored entity indicates a high level of sophistication and resources behind TA446's operations. In conclusion, TA446 represents a serious and evolving threat to global cybersecurity, particularly for entities involved in international affairs and defense.
What's your take? (Question 1 of 5)
Help tune the shared Cybergeist dataset, assist your peers, and earn karma. Expand the panel to get started.
Possible Aliases / Cluster overlaps
It's hard to track cluster overlaps and naming conventions between vendors, so here are some possible overlapping names / profiles you also may want to look at.
IDVotesProfile Description
COLDRIVER
3
Coldriver, also known as Callisto Group and Star Blizzard, is a threat actor believed to originate from Russia. This entity is recognized for its malicious activities including disinformation campaigns, spear-phishing attacks, and the use of custom malware. The group has been associated with the Rus
Seaborgium
3
Seaborgium, also known as Star Blizzard, Callisto Group, COLDRIVER, and TAG-53, is a threat actor linked to suspected Russian threat activity groups. Open-source reporting has enabled Insikt Group to profile the infrastructure used by this group, revealing significant overlaps with other known malic
Bluecharlie
2
BlueCharlie, also known as TAG-53, Blue Callisto, Callisto (or Calisto), COLDRIVER, Star Blizzard (formerly SEABORGIUM), and TA446, is a threat actor that has been linked to Russia and has reportedly been active since 2019. The group has been involved in various malicious activities including cybere
Callisto
2
Callisto, also known as Gossamer Bear, COLDRIVER, UNC4057, Star Blizzard, Blue Charlie, and SEABORGIUM, is a threat actor linked to the Russian state. This group, which has been tracked by various entities including Microsoft, Google's Threat Analysis Group (TAG), and Insikt Group, is known for its
Calisto
2
Calisto, also known as BlueCharlie, Blue Callisto, TAG-53, COLDRIVER, Star Blizzard (formerly SEABORGIUM), TA446, and UNC4057, is a threat actor that has been active since 2019. This group targets a wide range of sectors and is particularly focused on individuals and organizations involved in intern
Callisto Group
1
The Callisto Group, a threat actor identified as part of the Russian Federal Security Service, has been exposed by the United States and the United Kingdom for its malicious cyber activities. This group, also known as Coldriver and formerly tracked by Microsoft under the moniker "Seaborgium," is com
Blue Callisto
1
Blue Callisto, also known as COLDRIVER, BlueCharlie (or TAG-53), Calisto, Gossamer Bear, Star Blizzard (formerly SEABORGIUM), TA446, and UNC4057, is a malicious software program that has been active since 2019. This malware is designed to infiltrate computer systems and devices, often undetected, vi
Star Blizzard
1
Star Blizzard, also known as Seaborgium or the Callisto Group, is a threat actor linked to Russia's intelligence service, the FSB. The group has been involved in sophisticated cyber-attacks worldwide, primarily using spear-phishing campaigns to steal account credentials and data. Microsoft, which tr
Callisto Apt Group
1
None
Gossamer Bear
1
Gossamer Bear, also known as Callisto, Blue Callisto, BlueCharlie (or TAG-53), Calisto, Star Blizzard (formerly SEABORGIUM), TA446, and UNC4057, is a significant threat actor that has been active since 2019. The group primarily focuses on credential harvesting and conducts hack-and-leak campaigns ta
Miscellaneous Associations
Other elements of context that could aid in the identification of relevance
Blizzard
Apt
Government
Uk
Associated Malware
To see the evidence that has resulted in this association, create a free account
IDTypeVotesProfile Description
No associations to display
Associated Threat Actors
To see the evidence that has resulted in this association, create a free account
IDTypeVotesProfile Description
No associations to display
Associated Vulnerabilities
To see the evidence that has resulted in this association, create a free account
IDTypeVotesProfile Description
No associations to display
Source Document References
Information about the TA446 Threat Actor was read from the documents corpus below. This display is limited to 20 results, create a free account to see more
SourceCreatedAtTitle
Securityaffairs
6 months ago
Google TAG warns that Russian COLDRIVER APT is using a custom backdoor
CERT-EU
7 months ago
Microsoft Alert: COLDRIVER Credential Theft Rising Again
CERT-EU
7 months ago
UK names Russian FSB agents behind political hacking campaign | #hacking | #cybersecurity | #infosec | #comptia | #pentest | #hacker | National Cyber Security Consulting
CERT-EU
7 months ago
US, UK accuse Russia’s Callisto Group of cyber espionage, political interference
CERT-EU
7 months ago
Russian FSB Targets US and UK Politicians in Sneaky Spear-Phish Plan
CERT-EU
8 months ago
US and British authorities sanction, indict Russian hackers | #hacking | #cybersecurity | #infosec | #comptia | #pentest | #hacker | National Cyber Security Consulting
CERT-EU
8 months ago
UK and US expose Russia Callisto Group's activity and sanction members
CERT-EU
8 months ago
US and British authorities sanction, indict Russian hackers
CERT-EU
8 months ago
Microsoft Warns of COLDRIVER's Evolving Evading and Credential-Stealing Tactics
CERT-EU
a year ago
BlueCharlie changes attack infrastructure in response to reports on its activity
CERT-EU
8 months ago
Advanced threat predictions for 2024 – GIXtools
Securelist
8 months ago
Kaspersky Security Bulletin: APT predictions 2024
CERT-EU
a year ago
Russian Cyber Adversary BlueCharlie Alters Infrastructure in Response to Disclosures