Skip to content
skopnix
Section B · Adversaries · Dossier
← Adversaries

File · Callisto · Unknown · assessed origin Russia · misp-galaxy + mitre-attack · refreshed 2026-10-06

Callisto

  • COLDRIVER
  • SEABORGIUM
  • TA446
  • GOSSAMER BEAR
  • BlueCharlie
  • Star Blizzard
  • TAG-53
  • IRON FRONTIER

MITRE G1033 ↗

Callisto — ATT&CK roseCA

attack rose · 20 techniques across 8 tactics

Last 30 days

last seen 17 d ago
dispatches7
victims0
CVEs seen0

What changed

ledger · newest first
  1. —17 d agoresurfacedback on the wire — nothing in the previous 30 days

Analyst brief

misp-galaxy + mitre-attack

The Callisto Group is an advanced threat actor whose known targets include military personnel, government officials, think tanks, and journalists in Europe and the South Caucasus. Their primary interest appears to be gathering intelligence related to foreign and security policy in the Eastern Europe and South Caucasus regions.

Observed targets (as stated by the sources)

0 countries · 4 sectors
Assessed origin: Russia

assessed origin · Russiaobserved targets · 0

sectors · 4

  • Government Administration
  • Military
  • Think Tanks
  • Journalist

as stated by MISP galaxy / ransomware.live — not inferred

Kill chain

MITRE ATT&CK Enterprise · tap a technique

20 techniques · 8 of 15 tactics

  1. Reconnaissance

    4 techniques

  2. Resource development

    7 techniques

  3. Initial access

    1 technique

  4. Execution

    2 techniques

  5. Stealth

    2 techniques

  6. Credential access

    1 technique

  7. Lateral movement

    1 technique

  8. Collection

    2 techniques

select a technique

Arsenal

1 malware
Malware
Malware · 1ATT&CK
SpicaS1140 ↗

as stated by MITRE ATT&CK · “shared by” counts roster dossiers citing the same S-id

Take it with you

keyless · no signup

References

33 sources
  1. 1.web.archive.org/web/20170417102235/https://www.f-secure.com/documents/…
  2. 2.blog.google/threat-analysis-group/tracking-cyber-activity-eastern-…
  3. 3.blog.google/threat-analysis-group/update-on-cyber-activity-in-east…
  4. 4.blog.google/threat-analysis-group/continued-cyber-activity-in-east…
  5. 5.microsoft.com/security/blog/2022/08/15/disrupting-seaborgiums-ongoin…
  6. 6.blog.sekoia.io/calisto-continues-its-credential-harvesting-campaign
  7. 7.services.google.com/fh/files/blogs/google_fog_of_war_research_report.pdf
  8. 8.recordedfuture.com/research/bluecharlie-previously-tracked-as-tag-53-cont…
  9. 9.microsoft.com/en-us/security/blog/2023/12/07/star-blizzard-increases…
  10. 10.go.recordedfuture.com/hubfs/reports/cta-2022-1205.pdf
  11. +23 more in the JSON record

Track Callisto on the wire.

This dossier is already data: the keyless actor API and a STIX 2.1 bundle. Mentions on the wire reach Telegram and RSS as they land.

Follow on TelegramKEV RSSAPI

Check your stack

Paste what you run: the CVEs exploited in the wild against it, and who is cited as exploiting them, with the report.

Stack checkNo key. No signup.