Skip to content

Star Blizzard

Star Blizzard is a cyber espionage and influence group originating in Russia that has been active since at least 2019. Star Blizzard campaigns align closely with Russian state interests and have included persistent phishing and credential theft against academic, defense, government, NGO, and think tank organizations in NATO countries, particularly the US and the UK.

ATT&CK ID: G1033
Origin: Russia
Weather family: Blizzard
Techniques: 16
Tools: 1

Also tracked as SEABORGIUM · Callisto Group · TA446 · COLDRIVER

Techniques

Reconnaissance

Gather Victim Identity Information Search Open Websites/Domains Phishing for Information

Resource Development

Acquire Infrastructure Establish Accounts Compromise Accounts Obtain Capabilities Stage Capabilities

Initial Access

Valid Accounts Phishing

Execution

Command and Scripting Interpreter User Execution

Persistence

Privilege Escalation

Stealth

Valid Accounts Social Engineering

Credential Access

Steal Web Session Cookie

Lateral Movement

Use Alternate Authentication Material

Collection

Email Collection

Software

Spica

MITRE ATT&CK All threat actors