Star Blizzard

Star Blizzard is a Russia-linked cyber espionage threat actor publicly associated with the Russian Federal Security Service (FSB). Multiple governments and major security vendors have linked the group to the FSB, with reporting variously placing it under Centre 18 and describing it as an FSB-directed or FSB-sponsored operation. The actor is widely tracked under numerous aliases, including COLDRIVER, Callisto, Callisto Group, Seaborgium, TA446, UNC4057, BlueCharlie, Blue Callisto, Gossamer Bear, and related naming variants. Star Blizzard is best known for persistent, highly tailored spearphishing and credential theft operations against high-value individuals and organizations. Its targeting has included government and military personnel, diplomats, defense-related entities, former intelligence and military officers, journalists, think tanks, universities, NGOs, civil society organizations, Russian and Belarusian opposition figures, independent media, policy experts, and organizations connected to Ukraine, Russia, and Belarus. The group has also been linked to targeting parliamentarians and political institutions in the United Kingdom and to operations affecting U.S. government and defense-related personnel. The actor’s tradecraft centers on social engineering and account compromise rather than large-scale disruptive malware deployment. Star Blizzard commonly impersonates trusted contacts, subject-matter experts, government personnel, or organizations affiliated with the intended victim. It uses lookalike or spoofed email accounts, personalized lures, and fake document-sharing or protected-document themes to induce targets to reveal credentials. Observed techniques include adversary-in-the-middle phishing using Evilginx, browser fingerprinting and JavaScript-based redirection in phishing chains, theft of passwords and multi-factor authentication material, and harvesting of session cookies to obtain persistent access to webmail and cloud accounts. The group has also used malicious PDF lures and has uploaded payloads to cloud storage services. In separate activity, Star Blizzard has been associated with attempts to deliver malware, including PDF-based lures used to spread malicious payloads. Star Blizzard has repeatedly demonstrated strong target research and careful lure customization. Campaigns have often referenced plausible professional topics such as policy work, grants, media collaboration, diplomatic exchanges, or organizational business. In some operations, the group omitted attachments in initial outreach to provoke a reply and build trust before sending phishing material. This emphasis on believable interpersonal context has made the actor particularly effective against high-risk communities that rely heavily on email and remote collaboration. Beyond espionage, Star Blizzard has been linked to hack-and-leak activity in support of Russian state interests. Public reporting has tied the group to theft and subsequent release of politically sensitive material, including information used to influence narratives in the United Kingdom and other NATO countries. UK authorities have assessed that the group interfered in British politics and democratic processes, including targeting parliamentarians from multiple parties and compromising politically relevant documents. The actor has therefore occupied a hybrid role spanning intelligence collection, influence support, and suppression of dissent. Recent reporting also connects Star Blizzard to broader Russian efforts to compromise secure messaging users through phishing and social engineering, including activity resembling campaigns against Signal and WhatsApp users. Similar operations have sought credentials, verification codes, linked-device access, and backup recovery material from high-value targets in Ukraine, Europe, and the United States. While not every such campaign has been publicly attributed to a named actor, Star Blizzard has been repeatedly cited as one of the Russian clusters associated with this operational pattern. The group’s victimology and operational behavior are consistent with Russian intelligence priorities: collection against NATO countries and Ukraine-related targets, surveillance of dissidents and civil society, and acquisition of information that can be exploited for strategic influence. Star Blizzard remains one of the most prominent Russian phishing-focused espionage actors and is notable for sustained operations against political, diplomatic, and civil society targets rather than purely technical or opportunistic victim sets.