Unc4057

UNC4057, also known as ColdRiver, Star Blizzard, Blue Charlie, and Callisto, is a Russian-backed advanced persistent threat (APT) group that has been active since 2019. This group, sponsored by the Federal Security Service (FSB), has been involved in various malicious activities on behalf of the Russian government. The group uses a custom backdoor named "SPICA" to infiltrate systems, steal information, execute arbitrary commands, and establish persistence. They primarily target non-governmental organizations (NGOs), former intelligence and military officers, and NATO governments to carry out cyber espionage. Recently, Google's Threat Analysis Group (TAG) observed an evolution in UNC4057's tactics. The APT group has moved beyond phishing for credentials and started delivering malware through campaigns using PDFs as lure documents. This new approach involves poisoned PDF attachments in phishing messages that lead to the installation of a backdoor. This development has raised concerns among security researchers due to the group's notorious reputation and the potential threats it could pose. Over the years, UNC4057 has specialized in spear-phishing campaigns, employing advanced tactics including impersonation of known contacts customized to targets, and technical configurations and addresses made to look legitimate to recipients. The group's focus has been on high-profile individuals within NGOs, former intelligence and military officers, and NATO governments. Their evolving tactics and persistent threats underline the importance of continuous vigilance and proactive measures against such sophisticated cyber threats.