What other aliases and vendor names is DEV-0586 known by?

DEV-0586 is tracked across the cybersecurity industry by multiple aliases, including: Bleeding Bear, Blue Callisto, BlueCharlie, Cadet Blizzard, Callisto, Callisto Group, COLD RELIC, COLDRIVER.

What are the primary motivations and sponsors of DEV-0586?

DEV-0586 operates from Russia with primary motivation categorized as Espionage (credential theft for intelligence collection), sponsored or affiliated with Russian Government (GRU).

DEV-0586

ACTIVE CAMPAIGN TRACKED ▲ High Threat Russia

Primary Aliases: Bleeding Bear Cadet Blizzard DEV-0587 Ember Bear

Sponsor / State Affiliation Russian Government (GRU)

Primary Motivation Espionage (credential theft for intelligence collection)

Confidence Rating 88% (Grounded)

Targeting of European Think Tanks, Credential Harvesting Campaign Against NGOs, Spear‑Phishing of Ukrainian Government Entities

🎯 Target Sectors & Focus

Government agencies NATO and allied defense organizations Non‑governmental organizations (NGOs) Think tanks and policy research institutes Energy and critical infrastructure sectors