BlueCharlie, Previously Tracked as TAG-53, Continues to Deploy New Infrastructure in 2023

Insikt Group reports that BlueCharlie, a Russia-linked espionage-focused threat actor active since 2017, has developed 94 new domains and altered TTPs consistent with phishing and credential-harvesting campaigns targeting government, defense, education, political organizations, NGOs, journalists, and think tanks; the analysis highlights the actor’s operational evolution and recommends stronger phishing defenses, FIDO2 MFA, threat intelligence usage, and vendor security education.