CallistoThreat actor
- blue callisto
- bluecharlie
- callisto group
- cold relic
- coldriver
- gossamer bear
- iron frontier
- seaborgium
- Star Blizzard
- ta446
- tag-53
- UNC4057
The Callisto Group is an advanced threat actor whose known targets include military personnel, government officials, think tanks, and journalists in Europe and the South Caucasus. Their primary interest appears to be gathering intelligence related to foreign and security policy in the Eastern Europe and South Caucasus regions.From MISP Galaxy
Last reported 9 days ago, by AhnLab ASEC13 reports
ATT&CK techniques
6 of 12 · each with the sentence it comes from- T1053.005Scheduled Task
“Callisto deployed CosmicPulse using RedFlick (a scheduled task-based delivery technique), while UAC-0099 attempted to disrupt AI analysis using GuardBreaker (an LLM-based obfuscation technique).”
- T1036Masquerading
“The end goal is to deploy a custom backdoor called CosmicPulse by setting up scheduled tasks using RedFlick through phishing emails masquerading as invitations.”
- T1218.002Control Panel
“VHDX, LNK, PDF, HTA, WSF, MSI, and Control Panel applets were combined.”
- T1505.003Web Shell
“…026-82078 and CVE-2026-81578, two PaperCut MF vulnerabilities, as zero-days to load an in-memory Java loader, which in turn deployed a web shell.”
- T1014Rootkit
“SIXZUT and JITTERLY: Newly launched security firm VirLabs looks at SIXZUT and JITTERLY, a Linux implant and a rootkit that are being planted by the Red Heron group on Gitea servers.”
- T1056.001Keylogging
“"The latest Python NodeStealer variant incorporates new spyware features, including keylogging, clipboard monitoring, and screenshot capture," Netskope said.”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
13 reports, newest first · the exact sentence from each-
September 2026 Threat Trend Report on APT Groups“Callisto (Star Blizzard), UAC-0099, and NightEagle have escalated their activities.”
-
P7 DarkSword iOS Exploit Kit Adds Crypto Wallet Data Theft and Remote Commands“…urkish commercial surveillance vendor named PARS Defense via a fake Snapchat-themed website and a Russia-aligned threat actor called Star Blizzard (aka COLDRIVER) using fake invitation lures.”
-
⚡ Weekly Recap: NetScaler and FortiMail 0-Days, AI Coding Leaks, Spectre v2 and Ransomware Arrests“Star Blizzard Uses Fake Invites to Deploy CosmicPulse — The Russian state-sponsored threat actor known as Star Blizzard has employed a new malware delivery technique called RedFlick in attacks targeting Ukrainian individuals and institutions as well as international non-governmen…”
-
5th October – Threat Intelligence Report“Researchers mapped Russia-linked Star Blizzard phishing campaigns targeting more than 100 organizations, primarily in the United States and United Kingdom.”
-
Russia's Star Blizzard Ditches ClickFix to Widen Phishing Net“Russia's Star Blizzard Ditches ClickFix to Widen Phishing Net”
-
Russian FSB-linked hackers scale up phishing attacks against Ukraine supporters“The Russian state-backed hacking group Star Blizzard has expanded its phishing operations this year, using a new technique that makes it easier to infect victims with malware.”
-
Russian APT Star Blizzard Uses ‘RedFlick’ Infection Chain in Recent Attacks“Russian APT Star Blizzard Uses ‘RedFlick’ Infection Chain in Recent Attacks”
-
Risky Bulletin: Sanctions force CAs to revoke TLS certs in Iran, Russia“Star Blizzard changes tactics: Russian cyber-espionage group Star Blizzard has updated its tactics this year and has moved from targeted spear-phishing attacks to conducting mass-scale phishing campaigns.”
-
Russian hackers Star Blizzard expand targeting, change up tactics to reach Ukraine and beyond“Russian hackers Star Blizzard expand targeting, change up tactics to reach Ukraine and beyond”
-
Russia's Star Blizzard Targets 100+ Organizations With Fake Event Invites to Deliver Backdoor“Russia's Star Blizzard Targets 100+ Organizations With Fake Event Invites to Deliver Backdoor”
-
Star Blizzard refines phishing and malware delivery with the RedFlick technique“Star Blizzard refines phishing and malware delivery with the RedFlick technique”
-
The Bear Necessities: A Look at the Drivers, Dynamics, and Applications of the Pro-Russia Influence Ecosystem“In 2022, UNC4057 (COLDRIVER) used data stolen from espionage targets in a high profile hack-and-leak operation seeking to exacerbate divisions in UK politics.”
-
French NGO reporters without borders targeted by Calisto“Calisto, also known as ColdRiver or Star Blizzard, is a Russia-nexus intrusion set attributed to the FSB's Center 18.”
Indicators in its reports
named in the reports above- 103.160.59[.]97in 2 reports
- secure-dns-hub[.]comin 2 reports
- account.simpleasip[.]orgin 1 report
- scorelikelygateway.simleasip[.]orgin 1 report
- hxxps://account.proton[.]me/assets/static/public-index.7162a3fd.jsin 1 report
- 196.44.117[.]196in 1 report
- hxxps://admin.artemood[.]com/vendor/plugx/*.phpin 1 report
Copy these 7 indicators · defanged
Thanks — we review every report.