BlueCharlie, Previously Tracked as TAG-53, Continues to Deploy New Infrastructure in 2023

Recorded Future's Insikt Group attributes new infrastructure and active credential-harvesting phishing campaigns to BlueCharlie (previously TAG-53), a Russia-linked APT. Since March 2023 the group has spun up 94 domains and many IPs across specific registrars and ASNs, shifted domain-naming conventions and TTPs in response to public reporting, continues to rely on Let’s Encrypt certificates, and poses a persistent phishing threat to government, defense, higher education, NGOs, and related sectors; the report includes IOCs, ASN/registrar patterns, mitigations, and ATT&CK mappings.