Blue Callisto orbits around US Laboratories in 2022

Fingerprinting activity

In February 2022, we observed a domain we attribute likely to Blue Callisto redirecting to a different domain, which we also assess is likely Blue Callisto due to the similarities in technologies, network providers and infrastructure setup.⁵  When visiting the domain cache-dns-forwarding[.]com a user is redirected to accounts[.]hypertexttech[.]com due to a remote script shown in Figure 1. The remote script was located on hypertextteches[.]com.

Figure 1 – Javascript code link observed on cache-dns-forwarding[.]com

The web response from the remote script was obfuscated JavaScript code created by a popular JavaScript obfuscator⁶, which uses a combination of the following characters: ![ ]() as shown in Figure 2.

Figure 2 – Obfuscated JavaScript code

The deobfuscated code contains multiple client side checks, shown in Figure 3, to determine whether the request should be redirected or not. We assess it is likely the threat actor is using this code to identify automated scanners and antivirus technologies, and block them from the final phishing URL. The code queries several browser constants, such as:

• window.webdriver;
• window.domAutomation; and,
• window.spawn.

If the code does not identify any problems with the request the script will redirect to the following URL:

hxxps[:]//hypertextteches[.]com/patrified.php

Figure 3 – Deobfuscated code

Microsoft referenced Blue Callisto fingerprinting browser behaviour in one of its public blogs⁷. We assess the fingerprinting Javascript methods and code  is likely similar to the deobfuscated code we have observed. The JavaScript code redirect has several further redirections before reaching its final URL: a Google themed phishing page shown in Figure 4. An example redirection chain is listed below:

• hxxps[:]//hypertextteches[.]com/patrified.php;
• hxxps[:]//accounts[.]hypertexttech[.]com/oOzMeNTe?FtC=DLOJmne17BQw5JRQ74YDgmHxR52d0Ng
• hxxps[:]//accounts[.]hypertexttech[.]com/signin/v2/identifier?passive=1209600&continue=https%3A%2F%2Faccounts[.]google[.]com%2F&followup=https%3A
  %2F%2Faccounts[.]google[.]com%2F&flowName=GlifWebSignIn&flowEntry=ServiceLogin
• hxxps[:]//accounts[.]hypertexttech[.]com/ServiceLogin?
  continue=https%3A%2F%2Faccounts[.]google[.]com%2F&flowEntry=ServiceLogin&flowName=
  GlifWebSignIn&followup=https%3A%2F%2Faccounts[.]google[.]com%2F&passive=1209600

Figure 4 – Google themed phishing page

The phishing page contains an email address that we assess is likely used by Blue Callisto for testing. The page statically sets the email address value to tr333lopex as shown in Figure 5.

Figure 5 – Statically set email observed in code

Conclusion

Despite limited observations of broad activity, Blue Callisto is highly likely to remain active. In October 2022, we observed the threat actor is interested in an organisation which investigates war crimes; motives that would broadly align with a Russia-based threat group’s collection objectives. The threat actor’s tools, techniques and procedures (TTPs) contained slight shifts during 2022, such as network provider preferences and use of phishing technologies such as Evilginx. However, the threat actor continues to use some TTPs observed as far back as 2019 and continues to enjoy success from its phishing activity using legacy tradecraft.

MITRE ATT&CK

Phishing: Spearphishing Link - https://attack.mitre.org/techniques/T1566/002/Command and

Scripting Interpreter: JavaScript - https://attack.mitre.org/techniques/T1059/007/

Deobfuscate/Decode Files or Information - https://attack.mitre.org/techniques/T1140/

System Information Discovery - https://attack.mitre.org/techniques/T1082/