Threat actor
COLDRIVER
Russia
Tracked by CyberSIXT since 25 Sep 2025
- Articles · all time
- 17
- Articles · last 30 days
- 5
- CVEs exploited · attributed · all time
- 0
- Research reports · all time
- 2
17 articles from 1 outlet; the latest 25 days ago.
- Article
- Research report
Show as table
Names and sources
- Callisto
- Named by CyberSIXT coverage
- Blue Callisto
- Named by Malpedia · callisto
- BlueCharlie
- Named by Malpedia · callisto
- COLD RELIC
- Named by Malpedia · callisto
- COLDRIVER
- Named by Malpedia · callisto
- Callisto
- Named by Malpedia · callisto
- Callisto Group
- Named by Malpedia · callisto
- GOSSAMER BEAR
- Named by Malpedia · callisto
All 42 names
- IRON FRONTIER
- Named by Malpedia · callisto
- Reuse Team
- Named by Malpedia · callisto
- SEABORGIUM
- Named by Malpedia · callisto
- Star Blizzard
- Named by Malpedia · callisto
- TA446
- Named by Malpedia · callisto
- TAG-53
- Named by Malpedia · callisto
- UNC4057
- Named by Malpedia · callisto
- BlueCharlie
- Named by Microsoft · Star Blizzard
- COLDRIVER
- Named by Microsoft · Star Blizzard
- Callisto Group
- Named by Microsoft · Star Blizzard
- SEABORGIUM
- Named by Microsoft · Star Blizzard
- Star Blizzard
- Named by Microsoft · Star Blizzard
- TA446
- Named by Microsoft · Star Blizzard
- Blue Callisto
- Named by MISP Galaxy · fbd279ab-c095-48dc-ba48-4bece3dd5b0f
- BlueCharlie
- Named by MISP Galaxy · fbd279ab-c095-48dc-ba48-4bece3dd5b0f
- COLD RELIC
- Named by MISP Galaxy · fbd279ab-c095-48dc-ba48-4bece3dd5b0f
- COLDRIVER
- Named by MISP Galaxy · fbd279ab-c095-48dc-ba48-4bece3dd5b0f
- Callisto
- Named by MISP Galaxy · fbd279ab-c095-48dc-ba48-4bece3dd5b0f
- GOSSAMER BEAR
- Named by MISP Galaxy · fbd279ab-c095-48dc-ba48-4bece3dd5b0f
- IRON FRONTIER
- Named by MISP Galaxy · fbd279ab-c095-48dc-ba48-4bece3dd5b0f
- Nahr Elbard
- Named by MISP Galaxy · 7d99d2f7-adf0-44e4-9044-d18ff6842a16
- Nahr el bared
- Named by MISP Galaxy · 7d99d2f7-adf0-44e4-9044-d18ff6842a16
- SEABORGIUM
- Named by MISP Galaxy · fbd279ab-c095-48dc-ba48-4bece3dd5b0f
- Star Blizzard
- Named by MISP Galaxy · fbd279ab-c095-48dc-ba48-4bece3dd5b0f
- TA446
- Named by MISP Galaxy · fbd279ab-c095-48dc-ba48-4bece3dd5b0f
- TAG-53
- Named by MISP Galaxy · fbd279ab-c095-48dc-ba48-4bece3dd5b0f
- UNC4057
- Named by MISP Galaxy · fbd279ab-c095-48dc-ba48-4bece3dd5b0f
- COLDRIVER
- Named by MITRE ATT&CK® · G1033
- Callisto Group
- Named by MITRE ATT&CK® · G1033
- SEABORGIUM
- Named by MITRE ATT&CK® · G1033
- Star Blizzard
- Named by MITRE ATT&CK® · G1033
- TA446
- Named by MITRE ATT&CK® · G1033
- ColdRiver
- Named by CyberSIXT coverage
- fbd279ab-c095-48dc-ba48-4bece3dd5b0f
- Named by CyberSIXT coverage
Attributed facts
- category
- state (Microsoft · Star Blizzard)
- origin
- Russia (Microsoft · Star Blizzard)
- origin
- Russia (MISP Galaxy · fbd279ab-c095-48dc-ba48-4bece3dd5b0f)
- sector
- Government Administration (MISP Galaxy · fbd279ab-c095-48dc-ba48-4bece3dd5b0f)
- sector
- Journalist (MISP Galaxy · fbd279ab-c095-48dc-ba48-4bece3dd5b0f)
- sector
- Military (MISP Galaxy · fbd279ab-c095-48dc-ba48-4bece3dd5b0f)
- sector
- Think Tanks (MISP Galaxy · fbd279ab-c095-48dc-ba48-4bece3dd5b0f)
Malware and tools
MITRE ATT&CK® techniques
From MITRE ATT&CK® · G1033
Resource Development
Persistence
- T1078
- Valid Accounts
Privilege Escalation
- T1078
- Valid Accounts
Stealth
- T1078
- Valid Accounts
Credential Access
- T1539
- Steal Web Session Cookie
Lateral Movement
- T1550.004
- Web Session Cookie
© 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. All techniques on MITRE ATT&CK
- Russian Star Blizzard Expands Phishing Campaign Against Ukraine’s AlliesSecurityOnline
- Russia-Linked Star Blizzard Expands Phishing with Faster RedFlick Malware AttacksDark Reading
- Star Blizzard’s RedFlick Phishing Chain Needs One Click to Deploy MalwareSecurityWeek
- Russian Star Blizzard Uses Fake Event Invites to Spy on 100 OrganisationsThe Hacker News
- Star Blizzard Scales Phishing Attacks With One Click Malware DeliveryMicrosoft
- Phishing kits bypass MFA, target US firms with AiTM at scaleSOCRadar
- Russian APT Star Blizzard Adopts DarkSword iOS Exploit KitSecurityWeek
- Russia-linked APT TA446 uses DarkSword exploit to target iPhone users in phishing waveSecurity Affairs
- TA446 Deploys Leaked DarkSword iOS Exploit Kit in Targeted Spear-Phishing CampaignThe Hacker News
- Russia-linked COLDRIVER speeds up malware evolution after LOSTKEYS exposureSecurity Affairs
- COLDRIVER APT Bounces Back: Deploys ‘ROBOT’ Malware Family Days After LOSTKEYS ExposureSecurityOnline
- Google Identifies Three New Russian Malware Families Created by COLDRIVER HackersThe Hacker News
The latest 12 are listed. See all 17 articles in the timeline.