Introduction
Star Blizzard is a cyber espionage and influence group originating in Russia that has been active since at least 2019. Star Blizzard campaigns align closely with Russian state interests and have included persistent phishing and credential theft against academic, defense, government, NGO, and think tank organizations in NATO countries, particularly the US and the UK. Microsoft Star Blizzard August 2022 CISA Star Blizzard Advisory December 2023 StarBlizzard Google TAG COLDRIVER January 2024
Activities and Tactics
Targeted Sectors: Government Administration, Military, Think Tanks, Journalist
Country of Origin: 🇷🇺 Russia
Notable Campaigns
Information pending cataloguing.
Tactics, Techniques, and Procedures (TTPs)
- T1684.001 Impersonation
- T1583.001 Domains
- T1114.002 Remote Email Collection
- T1550.004 Web Session Cookie
- T1204.002 Malicious File
- T1608.001 Upload Malware
- T1539 Steal Web Session Cookie
- T1589 Gather Victim Identity Information
- T1585.002 Email Accounts
- T1566.001 Spearphishing Attachment
- T1598.002 Spearphishing Attachment
- T1598.003 Spearphishing Link
- T1588.002 Tool
- T1583 Acquire Infrastructure
- T1114.003 Email Forwarding Rule
- T1585.001 Social Media Accounts
- T1078 Valid Accounts
- T1586.002 Email Accounts
- T1059.007 JavaScript
- T1593 Search Open Websites/Domains
- T1676 Linked Devices
ATT&CK technique IDs (denormalized)
- T1059.007
- T1078
- T1114.002
- T1114.003
- T1204.002
- T1539
- T1550.004
- T1566.001
- T1583
- T1583.001
- T1585.001
- T1585.002
- T1586.002
- T1588.002
- T1589
- T1593
- T1598.002
- T1598.003
- T1608.001
- T1676
- T1684.001
Notable Indicators of Compromise (IOCs)
No curated IOCs are currently published for this actor. This section will be updated when stable, attributable indicators are available.
Malware and Tools
- CyberGate:
- Cyber Eye RAT:
- Blizzard:
- Coldroot:
- RCS Galileo:
MITRE ATT&CK Software
Attribution and Evidence
Country of Origin: Russia Additional attribution information pending cataloguing.
References
[1] mitre-attack [6] CISA Star Blizzard Advisory December 2023 CISA, et al. (2023, December 7). Russian FSB Cyber Actor Star Blizzard Continues Worldwide Spear-phishing Campaigns. Retrieved June 13, 2024. [7] Microsoft Star Blizzard August 2022 Microsoft Threat Intelligence. (2022, August 15). Disrupting SEABORGIUM’s ongoing phishing operations. Retrieved June 13, 2024. [8] StarBlizzard Microsoft Threat Intelligence. (2023, December 7). Star Blizzard increases sophistication and evasion in ongoing attacks. Retrieved February 13, 2024. [9] Google TAG COLDRIVER January 2024 Shields, W. (2024, January 18). Russian threat group COLDRIVER expands its targeting of Western officials to include the use of malware. Retrieved June 13, 2024.
Recent News
Latest articles from security news feeds mentioning this actor.
- Russia’s Star Blizzard Ditches ClickFix to Widen Phishing Net DarkReading — 2026-09-30
- Russia’s Star Blizzard Targets 100+ Organizations With Fake Event Invites to Deliver Backdoor The Hacker News — 2026-09-29