FORENSIA

THREAT_ACTOR · G1033

Star Blizzard

Also known as: Star Blizzard, SEABORGIUM, Callisto Group, TA446, COLDRIVER

Profile

Star Blizzard is a cyber espionage and influence group originating in Russia that has been active since at least 2019. Star Blizzard campaigns align closely with Russian state interests and have included persistent phishing and credential theft against academic, defense, government, NGO, and think tank organizations in NATO countries, particularly the US and the UK.

MITRE ATT&CK ↗

Techniques

20 ATT&CK techniques attributed to this actor.

T1059.007 JavaScriptT1078 Valid AccountsT1114.002 Remote Email CollectionT1114.003 Email Forwarding RuleT1204.002 Malicious FileT1539 Steal Web Session CookieT1550.004 Web Session CookieT1566.001 Spearphishing AttachmentT1583 Acquire InfrastructureT1583.001 DomainsT1585.001 Social Media AccountsT1585.002 Email AccountsT1586.002 Email AccountsT1588.002 ToolT1589 Gather Victim Identity InformationT1593 Search Open Websites/DomainsT1598.002 Spearphishing AttachmentT1598.003 Spearphishing LinkT1608.001 Upload MalwareT1684.001 Impersonation

Software

1 malware/tools attributed to this actor.

Spica

Related corpus activity

8,581 indicators EXHIBIT techniques this actor uses. This is a shared-technique signal, not a first-party attribution to Star Blizzard.

IndicatorTypeFamilySevSrc
cve-2025-12057cve—851
cve-2021-29441cve—851
cve-2018-8007cve—851
cve-2026-3844cve—851
cve-2017-17215cve—852
cve-2026-1969cve—851
cve-2025-0921cve—852
cve-2024-1781cve—851
cve-2026-4368cveransomware851
cve-2026-0740cve—851
cve-2025-7852cve—851
cve-2016-0638cvephishing851
cve-2025-7443cve—851
cve-2025-34085cve—851
cve-2025-23304cve—852
cve-2025-66478cve—852
cve-2026-22584cve—852
cve-2025-68670cve—852
cve-2026-3102cve—853
cve-2022-47945cve—851
5ab41cf20315d2ea1385967d588159873a65ef5581a0b78de06c0d8617894194sha256phishing802
221a39856b37e3c682f62427f1e6b965b36a2405764689c914672770a01a1fa9sha256—801
60972abf5425c191c81bae117f1dedaea13d39bc52f367d5dff9ad1aa4b9c5casha256phishing802
123e80a34508c4dede7cc70e76931fcchash—803
a7bd8869293212e1671df90d2d41b96d4933eb9408b1111bd830e111a91bb202hashphishing802
5272917261d7091a59e00f9d09cd7eb1d3e111115a5b367f79a66d0d7c7b01f4sha256phishing802
22de84e8f29cba932cf65cf4dc1d333cb8b2e468204f97030712bee32691ac3bsha256phishing802
9c44bc9373377831c45dd0ac2661a28ehash—803
f4d77958a12a0778283d3e679b24b18f82e332c4hash—803
b8eed63ab9cbdca494f26a6f66bfd4a0a693b3f0hash—803

Showing the top 30 by severity of 8,581.