Threat Actor 🇷🇺 Russia

Callisto

Also known as: COLDRIVER · SEABORGIUM · TA446 · GOSSAMER BEAR · BlueCharlie · Star Blizzard · TAG-53 · IRON FRONTIER · UNC4057 · Blue Callisto

The Callisto Group is an advanced threat actor whose known targets include military personnel, government officials, think tanks, and journalists in Europe and the South Caucasus. Their primary interest appears to be gathering intelligence related to foreign and security policy in the Eastern Europe and South Caucasus regions.

Indicators of Compromise 31

Domain 66ds[.]lol Domain applicationformsubmit[.]me Domain blintepeeste[.]org Domain captchanom[.]top Domain documentsec[.]com Domain documentsec[.]online Domain inspectguarantee[.]org Domain ned-granting-opportunities[.]com Domain onstorageline[.]com Domain oxwoocat[.]org Domain preentootmist[.]org Domain southprovesolutions[.]com Domain system-healthadv[.]com Domain viewerdoconline[.]com Filename CosmicPulse.cpl Filename bootstrapper.py Filename decoy.pdf SHA-256 2e74f6bd9bf73131d3213399ed2f669ec5f75392de69edf8ce8196cd70eb6aee SHA-256 3b49904b68aedb6031318438ad2ff7be4bf9fd865339330495b177d5c4be69d1 SHA-256 87138f63974a8ccbbf5840c31165f1a4bf92a954bacccfbf1e7e5525d750aa48 SHA-256 b60100729de2f468caf686638ad513fe28ce61590d2b0d8db85af9edc5da98f9 SHA-256 bce2a7165ceead4e3601e311c72743e0059ec2cd734ce7acf5cc9f7d8795ba0f SHA-256 c4d0fba5aaafa40aef6836ed1414ae3eadc390e1969fdcb3b73c60fe7fb37897 SHA-256 e9c8f6a7dba6e84a7226af89e988ae5e4364e2ff2973c72e14277c0f1462109b SHA-256 f2da013157c09aec9ceba1d4ac1472ed049833bc878a23bc82fe7eacbad399f4 IP 156[.]239[.]230[.]120 IP 166[.]88[.]95[.]90 IP 23[.]148[.]212[.]237 IP 43[.]134[.]165[.]205 IP 47[.]102[.]192[.]23 IP 85[.]239[.]52[.]32

MITRE ATT&CK TTPs 17

Remote Services

Lateral Movement

Remote Desktop Protocol

Lateral Movement

SMB/Windows Admin Shares

Lateral Movement

Obfuscated Files or Information

Defense Evasion

Process Injection

Defense Evasion

Command and Scripting Interpreter

Windows Command Shell

Application Layer Protocol

Command And Control

Command And Control

System Information Discovery

Ingress Tool Transfer

Command And Control

Deobfuscate/Decode Files or Information

Defense Evasion

Source Articles

P7 DarkSword iOS Exploit Kit Adds Crypto Wallet Data Theft and Remote Commands

P7 DarkSword is a new variant of the DarkSword iOS exploit kit that enhances stealth and data theft capabilities, including exfiltration of iCloud Keychain, cryptocurrency wallet data, and remote command execution on compromised iPhones. The kit leverages previously undocumented iOS vulnerabilities CVE-2025-24201 and CVE-2025-31200 to escape browser sandbox and achieve kernel-level privileges. It has been used in attacks targeting Saudi Arabia, Turkey, Malaysia, and Ukraine by multiple threat actors, including PARS Defense and Star Blizzard. Researchers also identified active C2 infrastructure and open directories linked to Chinese-speaking operators running exploitation-as-a-service with a focus on cryptocurrency theft.

hacker-news ·2w ago

⚡ Weekly Recap: NetScaler and FortiMail 0-Days, AI Coding Leaks, Spectre v2 and Ransomware Arrests

Multiple critical zero-day vulnerabilities were exploited in the wild this week, including CVE-2026-88779 in Citrix NetScaler ADC and Gateway, and CVE-2026-104286 in Fortinet FortiMail, both allowing remote code execution or arbitrary file writes. Russian state-sponsored group Star Blizzard deployed a new malware delivery technique called RedFlick to install the CosmicPulse backdoor via phishing. A Chinese-linked post-compromise malware, NeedyMantis, has been used in targeted operations since October 2025. Additionally, law enforcement disrupted the KillSec ransomware group and arrested members of ShinyHunters. A new Spectre v2 variant, BTR, enables rapid extraction of Linux root password hashes on Intel systems.

hacker-news ·3w ago

Russian state hackers use new RedFlick technique to push malware

Russian state actor Star Blizzard has been using a new malware delivery technique called 'RedFlick' to deploy the CosmicPulse backdoor. The attack begins with a phishing email containing a password-protected archive with a malicious VHDX file and an LNK shortcut disguised as a PDF. Upon execution, it creates multiple scheduled tasks to evade detection and downloads a Control Panel applet (.cpl) payload named NOROBOT or BAITSWITCH, which fetches and executes the final backdoor. The campaign has targeted Ukrainian entities and international organizations supporting Ukraine, with over 100 organizations impacted since early 2026.

bleeping-computer ·3w ago

To Be (A Robot) or Not to Be: New Malware Attributed to Russia State-Sponsored COLDRIVER | Google Cloud Blog

Russian state-sponsored threat group COLDRIVER rapidly deployed new malware families following the public disclosure of its LOSTKEYS malware in May 2025. The group introduced a new infection chain centered around the NOROBOT DLL, delivered via a 'ClickFix' CAPTCHA-themed lure, leading to deployment of the YESROBOT and later MAYBEROBOT backdoors. COLDRIVER has shown aggressive development tempo, frequently evolving delivery mechanisms and evasion techniques to maintain access to high-value targets such as NGOs, policy advisors, and dissidents.

google-threat-intel