Thanks for signing up, a member of the Global PR team will be in touch with you shortly.
According to the report, the Callisto Group is responsible for several attacks in 2015 and 2016. And while the report does not identify specific victims, it does say the common theme amongst the group’s targets is a connection with foreign and security policy involving eastern Europe and the south Caucasus, suggesting intelligence gathering as the group’s motive.
The report notes that the group’s infrastructure has links with entities in Russia, Ukraine and China, but does not offer definitive conclusions about who is behind the group. The report also highlights that while there is evidence suggesting the group has ties with a nation-state, the specifics of that relationship are unclear.
“They act like nation-state attackers, but there’s also evidence linking them with infrastructure used by criminals,” said F-Secure’s security advisor Sean Sullivan. “So they could be an independent group that’s been contracted by a government to do this work, or possibly doing it on their own with the intent of selling the information to a government or intelligence agency. But there are several explanations in addition to these, and we can’t say one way or the other based on the current evidence.”
In addition to discussing the Callisto Group’s targets and motives, the report details the attack pattern the group uses to compromise their targets. According to the report, the Callisto Group use highly targeted phishing attacks to steal credentials for email accounts, as well as highly personalised, convincing spear phishing emails intended to infect their targets with malware. These spear phishing emails were often sent from email accounts compromised by the group’s previous phishing attacks.
The malware delivered by these spear phishing emails was designed to steal information from their targets, as well as infect them with additional malware. The report notes that this malware is a variant of the Scout tool developed by Italian surveillance firm HackingTeam. The Scout tool was part of a spyware toolset HackingTeam sold to government agencies that was stolen and leaked online in 2015*.
According to F-Secure’s chief information security officer Erka Koivunen, the Callisto Group’s use of spyware designed for law enforcement is a stark reminder of the dangers of surveillance technologies.
“The adoption of government-grade spyware by attackers shouldn’t surprise anyone. Surveillance tools are by their very nature designed to invade people’s privacy. In well-functioning democracies these invasions are mandated by laws, and citizens rely on authorities to use them responsibly with proper checks and balances in place,” said Koivunen. “But data breaches and subsequent leaks of professional-grade surveillance tools give these invasive capabilities to a range of different threats. This should remind governments that we don’t have monopolies on these technologies, and that mercenaries, hostile nation-states, and other threats won’t hesitate to use these surveillance powers against us.”
The report highlights that the group remains active, and that how they’ll respond to being discovered is unknown. It also provides indicators of compromise and mitigation strategies for any potential targets concerned about the Callisto Group or other threats using similar attacks. F-Secure products currently feature behavioural, generic and other detections to protect users from Callisto Group activity.
Nobody has better visibility into real-life cyber attacks than F-Secure. We’re closing the gap between detection and response, utilizing the unmatched threat intelligence of hundreds of our industry’s best technical consultants, millions of devices running our award-winning software, and ceaseless innovations in artificial intelligence. Top banks, airlines, and enterprises trust our commitment to beating the world’s most potent threats. Together with our network of the top channel partners and over 200 service providers, we’re on a mission to make sure everyone has the enterprise-grade cyber security we all need.
Founded in 1988, F-Secure is listed on the NASDAQ OMX Helsinki Ltd.
Sign up for media information from F-Secure.
Browse through our news by year.
Browse through our news by category.