← All threat actors
Star BlizzardG1033 ↗
VirusTotal tracks this as Callisto.
The Callisto Group is an advanced threat actor whose known targets include military personnel, government officials, think tanks, and journalists in Europe and the South Caucasus. Their primary interest appears to be gathering intelligence related to foreign and security policy in the Eastern Europe and South Caucasus regions.
Motivation
Unknown
Suspected origin
Russian Federation
Reports / IOCs (VT)
115 reports · 96 IOCs
Reported activity
2017 – 2026
Targeted industries
Civil Society & Non-ProfitsAerospace & DefenseMedia & Entertainment
Targeted regions
—Associated malware (4)
LOSTKEYSMAYBEROBOTNOROBOTYESROBOT
ATT&CK techniques in reports
- T1566.001 Spearphishing Attachment4
- T1583.001 Domains4
- T1078 Valid Accounts4
- T1059 Command and Scripting Interpreter3
- T1059.007 JavaScript3
- T1082 System Information Discovery3
- T1140 Deobfuscate/Decode Files or Information3
- T1204.002 Malicious File3
- T1027.009 Embedded Payloads2
- T1036 Masquerading2
- T1070.004 File Deletion2
- T1083 File and Directory Discovery2
- T1564.003 Hidden Window2
- T1566.002 Spearphishing Link2
- T1556 Modify Authentication Process2
- T1566 Phishing2
- T1114.002 Remote Email Collection2
- T1114.003 Email Forwarding Rule2
- T1539 Steal Web Session Cookie2
- T1550.004 Web Session Cookie2
Also known as
BlueCharlie, GOSSAMER BEAR, TAG-53, Blue Callisto, TA446, IRON FRONTIER, UNC4057, Star Blizzard, COLD RELIC, COLDRIVER, SEABORGIUM