Threat feed IOCs (0)

Indicators from free threat feeds (abuse.ch ThreatFox, AlienVault OTX) attributed to Callisto. Each row shows why it was linked and where it came from.

No feed indicators linked to this actor yet. Feeds are checked every hour.

Public research & publications (33)

Open-source reports about this actor collected from MISP Galaxy and MITRE ATT&CK.

• attack.mitre.orghttps://attack.mitre.org/groups/G1033
• blog.googlehttps://blog.google/threat-analysis-group/google-tag-coldriver-russian-phishing-malware/
• cisa.govhttps://www.cisa.gov/news-events/cybersecurity-advisories/aa23-341a
• microsoft.comhttps://www.microsoft.com/en-us/security/blog/2022/08/15/disrupting-seaborgiums-ongoing-phishing-operations/
• microsoft.comhttps://www.microsoft.com/en-us/security/blog/2023/12/07/star-blizzard-increases-sophistication-and-evasion-in-ongoing-attacks/
• web.archive.orghttps://web.archive.org/web/20170417102235/https://www.f-secure.com/documents/996508/1030745/callisto-group
• blog.googlehttps://blog.google/threat-analysis-group/tracking-cyber-activity-eastern-europe
• blog.googlehttps://blog.google/threat-analysis-group/update-on-cyber-activity-in-eastern-europe
• blog.googlehttps://blog.google/threat-analysis-group/continued-cyber-activity-in-eastern-europe-observed-by-tag
• microsoft.comhttps://www.microsoft.com/security/blog/2022/08/15/disrupting-seaborgiums-ongoing-phishing-operations
• blog.sekoia.iohttps://blog.sekoia.io/calisto-continues-its-credential-harvesting-campaign
• services.google.comhttps://services.google.com/fh/files/blogs/google_fog_of_war_research_report.pdf
• recordedfuture.comhttps://www.recordedfuture.com/research/bluecharlie-previously-tracked-as-tag-53-continues-to-deploy-new-infrastructure-in-2023
• go.recordedfuture.comhttps://go.recordedfuture.com/hubfs/reports/cta-2022-1205.pdf
• pwc.comhttps://www.pwc.com/gx/en/issues/cybersecurity/cyber-threat-intelligence/blue-callisto-orbits-around-us.html
• ncsc.gov.ukhttps://www.ncsc.gov.uk/files/Advisory-Russian-FSB-cyber-actor-star-blizzard-continues-worldwide-spear-sphishing-campaigns.pdf
• cloud.google.comhttps://cloud.google.com/blog/topics/threat-intelligence/cyber-threats-global-elections
• cloud.google.comhttps://cloud.google.com/blog/topics/threat-intelligence/cyber-threats-2024-paris-olympics
• blog.googlehttps://blog.google/threat-analysis-group/google-tag-coldriver-russian-phishing-malware
• citizenlab.cahttps://citizenlab.ca/2024/08/sophisticated-phishing-targets-russias-perceived-enemies-around-the-globe/
• gov.ukhttps://www.gov.uk/government/news/uk-exposes-attempted-russian-cyber-interference-in-politics-and-democratic-processes
• pwc.comhttps://www.pwc.com/gx/en/issues/cybersecurity/cyber-threat-intelligence/coldwastrel-space.html
• citizenlab.cahttps://citizenlab.ca/2024/10/disrupting-coldriver/
• blogs.microsoft.comhttps://blogs.microsoft.com/on-the-issues/2024/10/03/protecting-democratic-institutions-from-cyber-threats/
• justice.govhttps://www.justice.gov/opa/pr/justice-department-disrupts-russian-intelligence-spear-phishing-efforts
• justice.govhttps://www.justice.gov/opa/pr/two-russian-nationals-working-russias-federal-security-service-charged-global-computer
• justice.govhttps://www.justice.gov/opa/media/1327601/dl?inline
• noticeofpleadings.comhttps://www.noticeofpleadings.com/starblizzard/
• edeca.nethttps://edeca.net/post/2024-06-26-an-interesting-callisto-yara-rule
• blog.sekoia.iohttps://blog.sekoia.io/calisto-show-interests-into-entities-involved-in-ukraine-war-support
• blog.sekoia.iohttps://blog.sekoia.io/one-year-after-the-cyber-implications-of-the-russo-ukrainian-war/
• blog.sekoia.iohttps://blog.sekoia.io/calisto-doxxing-sekoia-io-findings-concurs-to-reuters-investigation-on-fsb-related-andrey-korinets/
• cloud.google.comhttps://cloud.google.com/blog/topics/threat-intelligence/updated-cyber-threat-actor-naming-system/