ADVERSARY UNMASKED APT PROFILE – STAR BLIZZARD

ADVERSARY UNMASKED APT PROFILE – STAR BLIZZARD

Star Blizzard, also known as SEABORGIUM, is a highly persistent threat actor known for repeatedly targeting the same organisations over extended periods. Following initial compromise, Star Blizzard gradually expands its access by infiltrating victims’ social networks through persistent impersonation, relationship building, and phishing. The group has consistently compromised organisations and individuals of interest over several years, while largely maintaining the same established tactics and methodologies.

Alias: SEABORGIUM, COLDRIVER, UNC4057, Callisto Group, TA446, BlueCharlie, TAG-53

Motivation: Espionage through credential and data theft against people of political interest; hack-and-leak operations (UK attribution).

Targeted Industries

Targeted Countries:
United Kingdom and United States (most targeted); Ukraine; other NATO members and Russia’s neighbours, including Canada, Estonia, France, Germany, Greece, Italy, Latvia, Lithuania, Norway, Poland, Sweden and Switzerland; Russian opposition figures, independent media and exiles inside and outside the Russian Federation.

Targeted Technologies:
Microsoft Windows endpoints; Microsoft 365 and consumer webmail accounts (Proton, Gmail, Outlook, Yahoo); WhatsApp; Apple iOS. Compromised cPanel and WordPress sites are used as sending and redirect infrastructure rather than as victim technologies.

Malware used by Star Blizzard:
SPICA backdoor; EvilGinx adversary-in-the-middle phishing kit; COLDCOPY fake-CAPTCHA (ClickFix) lure; LOSTKEYS; NOROBOT downloader (also BAITSWITCH); YESROBOT Python backdoor (also CosmicPulse); MAYBEROBOT PowerShell backdoor (also SIMPLEFIX); RedFlick delivery chain; leaked DarkSword iOS exploit kit with the GHOSTBLADE dataminer.

PROFILE

TARGETING DETAILS

Recent Activity and Trends

Recent Campaign Highlights
September 2026 – Microsoft reporting (29 September 2026) assesses that Star Blizzard has expanded from targeted spear-phishing to broader campaigns against Ukrainian entities, NGOs, think tanks, governments and financial institutions (moderate confidence). Its RedFlick delivery technique uses malicious VHDX files, compromised websites, scheduled tasks, and concealed payloads to deploy the CosmicPulse backdoor, indicating an effort to improve delivery reliability, evade detection, and sustain cyber-espionage operations.

ACTIVITY TIMELINE, DECEMBER 2023 TO SEPTEMBER 2026

SHIFTS IN BEHAVIOUR

• From account theft to endpoint malware. Until 2024, the group mostly stole mailbox credentials and session cookies. Since 2025, most reported campaigns install a backdoor on the victim’s device.
• From one-to-one to bulk phishing. 2026 campaigns ran to tens or hundreds of emails each, a scale not previously seen from this actor and likely enabled by a mass-mailing platform.
• First reported mobile exploitation. The March 2026 use of DarkSword relied on a kit that had leaked publicly, not on in-house exploit development.
• Broader target set. Financial organisations, technology firms and hotels in Kyiv appear in 2026 alongside the traditional policy community.
• Fast retooling after exposure. New malware was in use five days after its tooling was exposed in May 2025. The final-stage backdoor changed little while delivery components changed often. Blocking known indicators alone is therefore insufficient; identity protection, user reporting and behaviour-based detection are needed.

LIKELY NEXT MOVES (ANALYST ASSESSMENT, MODERATE CONFIDENCE)

• Changes to RedFlick delivery components and CosmicPulse within weeks of their public exposure in late September 2026, following the 2025 precedent.
• Continued event-invitation lures tied to Ukraine-related policy conferences, and payment-themed lures against financial organisations.
• Further iPhone targeting of high-value individuals, depending on the availability of public or leaked exploit chains.
• Continued focus on personal email and messaging accounts, which sit outside corporate security controls.

VULNERABILITIES SOMETIMES MIS-ATTRIBUTED TO STAR BLIZZARD

Star Blizzard’s documented intrusions rely on social engineering and stolen credentials, not on exploiting vulnerabilities. The CVEs above appear in some aggregated feeds against this actor but have no public link to it. The only exploitation publicly linked to the group is the DarkSword iOS chain in March 2026, below.

VULNERABILITIES LINKED TO STAR BLIZZARD IN 2026 REPORTING: DARKSWORD iOS CHAIN

DarkSword was used by several actors before it leaked publicly in March 2026. In Star Blizzard’s reported use (Proofpoint, March 2026), the redirector, loader, remote code execution and PAC-bypass stages were observed; delivery of the sandbox-escape and kernel stages was not confirmed. CVE details and fix versions are taken from Google Threat Intelligence Group and Apple security release notes (see References).

TTPs MAPPED TO MITRE ATT&CK (ENTERPRISE AND MOBILE)

DETECTION GUIDANCE AND HUNTING QUERIES
Queries are written for Microsoft Defender XDR advanced hunting. Some will match legitimate activity; validate and tune them in your environment before alerting.

1. SSH used to run a local command (RedFlick, January 2026)
DeviceProcessEvents| where Timestamp > ago(30d)| where FileName =~ “ssh.exe”| where ProcessCommandLine has “PermitLocalCommand” and ProcessCommandLine has “LocalCommand”| project Timestamp, DeviceName, AccountName, InitiatingProcessFileName, ProcessCommandLine

2. conhost.exe launching curl.exe (RedFlick, July 2026)
DeviceProcessEvents| where Timestamp > ago(30d)| where InitiatingProcessFileName =~ “conhost.exe” and FileName =~ “curl.exe”| project Timestamp, DeviceName, AccountName, ProcessCommandLine, InitiatingProcessParentFileName
Note: In the July 2026 RedFlick chain, the LNK launches a hidden conhost.exe, which spawns curl.exe to fetch the next stage, so conhost appears as the parent. Confirm the grandparent (InitiatingProcessParentFileName) traces back to an LNK launched from an archive or mounted VHDX before escalating.

3. Scheduled tasks using names reported for this actor
let names = dynamic([“Internet Quality Test Connection”, “Network Configuration Manager”, “System Health Monitor”, “System health check”]);union (DeviceEvents | where Timestamp > ago(90d) and ActionType == “ScheduledTaskCreated” | extend TaskName = tostring(parse_json(AdditionalFields).TaskName) | where TaskName has_any (names)), (DeviceProcessEvents | where Timestamp > ago(90d) and FileName =~ “schtasks.exe” | where ProcessCommandLine has_any (names) | extend TaskName = extract(@’/tn\s+”?([^”/]+)’, 1, ProcessCommandLine))| project Timestamp, DeviceName, AccountName, ActionType, TaskName, ProcessCommandLine

4. Control Panel or rundll32 loading code from WebDAV or user-writable paths
DeviceProcessEvents| where Timestamp > ago(30d)| where FileName in~ (“control.exe”, “rundll32.exe”)| where ProcessCommandLine has_any (“Control_RunDLL”, “.cpl”)| where ProcessCommandLine contains @”\\” or ProcessCommandLine has_any (“DavWWWRoot”, “@SSL”, “AppData”, “Temp”)| project Timestamp, DeviceName, AccountName, ProcessCommandLine, InitiatingProcessFileName

5. Fake-CAPTCHA (ClickFix) commands typed into the Run dialog
DeviceRegistryEvents| where Timestamp > ago(30d)| where RegistryKey has @”\Explorer\RunMRU”| where RegistryValueData has_any (“rundll32”, “powershell”, “mshta”, “curl”, “bitsadmin”)| project Timestamp, DeviceName, InitiatingProcessAccountName, RegistryValueData

6. Registry key used by the CosmicPulse downloader
DeviceRegistryEvents| where Timestamp > ago(90d)| where RegistryKey has @”Software\Classes\.mollis”| project Timestamp, DeviceName, ActionType, RegistryKey, InitiatingProcessFileName

7. Python runtime started from a user profile by the task scheduler
DeviceProcessEvents| where Timestamp > ago(30d)| where FileName in~ (“python.exe”, “pythonw.exe”) and FolderPath has @”\AppData\”| where InitiatingProcessFileName in~ (“svchost.exe”, “control.exe”, “rundll32.exe”, “cmd.exe”)| summarize count(), make_set(ProcessCommandLine, 5) by DeviceName, FolderPath

8. Mailbox forwarding rules created or changed (Microsoft 365)
CloudAppEvents| where Timestamp > ago(30d)| where ActionType in (“New-InboxRule”, “Set-InboxRule”, “UpdateInboxRules”)| where RawEventData has_any (“ForwardTo”, “RedirectTo”, “ForwardAsAttachmentTo”)| project Timestamp, AccountDisplayName, IPAddress, ActionType, RawEventData

INDICATORS OF COMPROMISE
Indicators are defanged. The 2026 infrastructure was rotated roughly monthly, and the 2025 set is over a year old, so treat matches as leads for investigation and expect low hit rates.

WHAT THIS MEANS FOR YOU

• Does this affect me? Star Blizzard targets people more than networks: government and diplomatic staff, defence, think tanks, NGOs, academia, media and, since 2026, financial organisations. Its focus is the UK, the US, Europe and Ukraine; public reporting on other regions is limited. For organisations outside those regions, relevance is by role: staff working on policy, defence, sanctions, Ukraine-related programmes or international finance, and executives with public profiles.
• How exposed am I? Exposure sits mostly outside corporate controls: personal webmail and WhatsApp accounts of those staff, and iPhones below iOS 26.3. On corporate systems, exposure is highest where Microsoft 365 accounts lack phishing-resistant MFA, users can mount VHDX files or run LNK files from archives, and workstations can make outbound SSH connections.
• What should I do now? Brief high-risk staff on event-invitation lures that arrive without an attachment and follow up with a password-protected archive. Move them to phishing-resistant MFA and current iOS. Run the hunting queries above and the mitigations below.

PRIORITISED MITIGATIONS

REFERENCES

• NCSC, CISA, FBI, NSA, CNMF, ACSC, CCCS and NCSC-NZ, joint advisory “Russian FSB cyber actor Star Blizzard continues worldwide spear-phishing campaigns”, 7 December 2023. https://media.defense.gov/2023/Dec/07/2003353251/-1/-1/0/ADVISORY-RUSSIAN-FSB-CYBER-ACTOR-STAR-BLIZZARD-CONTINUES-WORLDWIDE-SPEAR-SPHISHING-CAMPAIGNS.PDF
• Microsoft Threat Intelligence, “Star Blizzard increases sophistication and evasion in ongoing attacks”, 7 December 2023. https://www.microsoft.com/en-us/security/blog/2023/12/07/star-blizzard-increases-sophistication-and-evasion-in-ongoing-attacks/
• US Department of Justice, indictment of Ruslan Aleksandrovich Peretyatko and Andrey Stanislavovich Korinets, with US Treasury (OFAC) and UK FCDO sanctions designations, 7 December 2023.
• Google Threat Analysis Group, “Russian threat group COLDRIVER expands its targeting of Western officials to include the use of malware” (SPICA), 18 January 2024. https://blog.google/threat-analysis-group/google-tag-coldriver-russian-phishing-malware/
• Access Now and The Citizen Lab, “Rivers of Phish: SMS and email phishing campaigns targeting Russian civil society”, August 2024.
• US Department of Justice, “Justice Department disrupts Russian intelligence spear-phishing efforts” (with Microsoft Digital Crimes Unit), 3 October 2024. https://www.justice.gov/usao-ndca/pr/justice-department-disrupts-russian-intelligence-spear-phishing-efforts
• Microsoft Threat Intelligence, “New Star Blizzard spear-phishing campaign targets WhatsApp accounts”, 16 January 2025. https://www.microsoft.com/en-us/security/blog/?p=132682
• Google Threat Intelligence Group, “COLDRIVER using new malware to steal documents from Western targets and NGOs” (LOSTKEYS, COLDCOPY), 7 May 2025. https://cloud.google.com/blog/topics/threat-intelligence/coldriver-steal-documents-western-targets-ngos
• Google Threat Intelligence Group, “To Be (A Robot) or Not to Be: New Malware Attributed to Russia State-Sponsored COLDRIVER” (NOROBOT / YESROBOT / MAYBEROBOT), 20 October 2025. https://cloud.google.com/blog/topics/threat-intelligence/new-malware-russia-coldriver/
• Zscaler ThreatLabz, “COLDRIVER updates arsenal with BAITSWITCH and SIMPLEFIX”, October 2025. https://www.zscaler.com/blogs/security-research/coldriver-updates-arsenal-baitswitch-and-simplefix
• Google Threat Intelligence Group, “DarkSword iOS exploit chain”, 18 March 2026. https://cloud.google.com/blog/topics/threat-intelligence/darksword-ios-exploit-chain
• Proofpoint, reporting on TA446 spear-phishing delivering the DarkSword iOS kit and MAYBEROBOT (emails sent 26 March 2026); secondary coverage: https://thehackernews.com/2026/03/ta446-deploys-leaked-darksword-ios.html
• Microsoft Threat Intelligence, “Star Blizzard refines phishing and malware delivery with the RedFlick technique”, 29 September 2026. https://www.microsoft.com/en-us/security/blog/2026/09/29/star-blizzard-refines-phishing-and-malware-delivery-with-the-redflick-technique/
• MITRE ATT&CK, Star Blizzard, G1033. https://attack.mitre.org/groups/G1033/ ; T1684.001 Social Engineering: Impersonation; T1676 Linked Devices (Mobile). https://attack.mitre.org/techniques/T1676/