🇷🇺

Callisto Group

APT Group Information theft and espionage 1 zero-day CVE ETDA ✓

Also Known As 12 names

BlueCharlie TAG-53 Callisto Group Blue Callisto SEABORGIUM COLDRIVER Star Blizzard IRON FRONTIER GOSSAMER BEAR Callisto UNC4057 TA446

Target Countries 5

Countries highlighted in red

Germany France United Kingdom Ukraine United States

Sectors Targeted

Defense Computer Systems Design and Related Services 54151 journalists Professional, Scientific, and Technical Services 54 Personal Care Services 8121 Public Administration 92 Investigation, Guard, and Armored Car Services 56161 Grantmaking and Giving Services 8132 Think Tanks National Security and International Affairs 9281 National Security and International Affairs 928 Periodical Publishers 51112 Government Management, Scientific, and Technical Consulting Services 5416 Employment Placement Agencies and Executive Search Services 56131 Electric Power Generation 22111 Information 51 Computer Systems Design Services 541512 Internet Publishing and Broadcasting and Web Search Portals 51913

Details

Origin 🇷🇺 RU

Last Updated 11 May 2024

MITRE ATT&CK 35

T1041 T1047 T1059 T1059.007 T1071.001 T1078 T1105 T1114 T1114.002 T1114.003 T1193 T1203 T1204 T1204.002 T1539 T1550 T1550.004 T1566 T1566.001 T1583 T1583.001 T1585 T1585.001 T1585.002 T1586 T1586.002 T1588 T1588.002 T1589 T1593 T1598 T1598.002 T1598.003 T1608 T1608.001

Related Zero-Days 1

CVE-2024-4947

Known Names 1 entries

Callisto Group F-Secure

Observed Target Countries 1

Based on ETDA data — countries highlighted in red

Europe and the South Caucasus

Description

(F-Secure) The most obvious common theme between all known targets of the Callisto Group is an involvement in European foreign and security policy, whether as a military or government official, being employed by a think tank, or working as a journalist. More specifically, many of the known targets have a clear relation to foreign and security policy involving both Eastern Europe and the South Caucasus. This targeting suggests the Callisto Group is interested in intelligence gathering related to foreign and security policy. Furthermore, we are unaware of any targeting in the described attacks that would suggest a financial motive. It is worth noting that during our investigation we uncovered links between infrastructure associated with the Callisto Group and infrastructure used to host online stores selling controlled substances. While we don’t yet know enough to fully understand the nature of these links, they do suggest the existence of connections between the Callisto Group and criminal actors. While the targeting would suggest that the main benefactor of the Callisto Group’s activity is a nation state with specific interest in the Eastern Europe and South Caucasus regions, the link to infrastructure used for the sale of controlled substances hints at the involvement of a criminal element. Finally, the infrastructure associated with the Callisto Group and related infrastructure contain links to at least Russia, Ukraine, and China in both the content hosted on the infrastructure, and in WHOIS information associated with the infrastructure. It is possible to come up with a number of plausible theories to explain the above findings. For example, a cybercrime group with ties to a nation state, such as acting on behalf of or for the benefit of a government agency, is one potential explanation. However, we do not believe it is possible to make any definitive assertions regarding the nature or affiliation of the Callisto Group based on the currently available information.

Tools Used 1

RCS Galileo

Reports & References 1

https://www.f-secure.com/documents/996508/1030745/callisto-group

ETDA Profile

Callisto Group

Origin

[Unknown]

First Seen 2013

Motivation

Information theft and espionage

View on ETDA APT Groups ↗