Callisto__2022__Message_from_Recorded_Future.pdf

This Recorded Future Insikt Group report profiles TAG-53's credential-harvesting infrastructure—likely overlapping with Callisto Group, COLDRIVER, and SEABORGIUM—detailing domain naming patterns, preferred registrars, Autonomous Systems, Let's Encrypt TLS usage, a spoofed Global Ordnance sign-in page, and appendices of 38 malicious domains and multiple IP addresses, and provides mitigation recommendations for network defenders.