Star Blizzard

Also known as: SEABORGIUM · Callisto Group · TA446 · COLDRIVER

Overview

Star Blizzard is a cyber espionage and influence group originating in Russia that has been active since at least 2019. Star Blizzard campaigns align closely with Russian state interests and have included persistent phishing and credential theft against academic, defense, government, NGO, and think tank organizations in NATO countries, particularly the US and the UK.

Naming & attribution

Star Blizzard is tracked under 5 names across the industry. It uses 20 documented ATT&CK techniques — more than 53% of the 174 groups tracked here. Activity attributed since at least 2019.

Who calls this group what — MITRE lists each alias with the report that used it, but not which vendor coined it.
Name	First reported by
SEABORGIUM	Microsoft Threat Intelligence
Callisto Group	CISA, et al
TA446	CISA, et al
COLDRIVER	Shields, W

Distinctive techniques

Techniques this group uses that are rare across the other 173 tracked groups — these carry more signal than the near-universal ones.

T1550.004 Web Session Cookie — used by 1 of 174 groups

Closest groups by technique overlap

Computed from shared ATT&CK techniques. Overlap is not attribution — distinct actors converge on the same tradecraft — but a high share is a useful pivot.

IndigoZebra China — 5 shared techniques (23% overlap)
Silent Librarian — 6 shared techniques (22% overlap)
EXOTIC LILY — 6 shared techniques (21% overlap)
APT-C-36 — 9 shared techniques (18% overlap)
WIRTE — 7 shared techniques (18% overlap)
CURIUM Iran — 6 shared techniques (18% overlap)

Malware families with current indicators

One family attributed to Star Blizzard, carrying 4 indicators currently tracked from abuse.ch ThreatFox, MalwareBazaar, URLhaus and SSLBL. MITRE documents what a group does; this is what its tooling is doing now.

SPICA 4 indicators

Browse or copy the indicators by hash, domain, IP or URL, filtered by age from 1 day to 3 years.

Targets

Government · Journalists · Military · Think Tanks

TTPs — 20 techniques across 8 tactics

Execution

T1059.007 JavaScript
T1204.002 Malicious File

Stealth

T1078 Valid Accounts
T1684.001 Impersonation

Credential Access

T1539 Steal Web Session Cookie

Lateral Movement

T1550.004 Web Session Cookie

Collection

T1114.002 Remote Email Collection
T1114.003 Email Forwarding Rule

Tools & malware (1)

Spica

Reporting (3)

Russian threat group COLDRIVER expands its targeting of Western officials to include the use of malware — Shields, W
Russian FSB Cyber Actor Star Blizzard Continues Worldwide Spear-phishing Campaigns — CISA, et al
Star Blizzard increases sophistication and evasion in ongoing attacks — Microsoft Threat Intelligence