Star Blizzard

Star Blizzard is a Russia-linked cyber espionage threat actor widely tracked under aliases including COLDRIVER, Callisto, Callisto Group, Seaborgium, TA446, UNC4057, BlueCharlie, Gossamer Bear, and related name variants. Multiple governments have publicly linked the group to the Russian Federal Security Service (FSB), and reporting has associated it with FSB structures including Centre 18; some government reporting has also described it as a Centre 16 subunit. The actor has been implicated in espionage, credential theft, and information operations aligned with Kremlin interests, including interference in political and democratic processes. The group is best known for highly tailored spearphishing and credential-harvesting campaigns against high-value individuals and organizations. Typical targets include government and military personnel, diplomats, former intelligence and defense officials, parliamentarians, journalists, think tanks, universities, NGOs, civil society organizations, Russian and Belarusian opposition figures, independent media, policy experts, and organizations involved in Ukraine-related issues. Targeting has spanned the United Kingdom, United States, NATO countries, Europe more broadly, and Russian dissidents abroad. Star Blizzard commonly uses impersonation-based social engineering, registering or operating spoofed accounts that mimic trusted contacts, subject-matter experts, colleagues, funders, or officials. Its phishing operations often rely on plausible professional pretexts and fake protected or encrypted document lures, especially PDF-themed workflows, to drive victims to credential theft pages. The actor has used adversary-in-the-middle techniques and incorporated the Evilginx framework into spearphishing activity to capture passwords, session material, and multi-factor authentication data. Observed tradecraft also includes JavaScript-based redirection from actor-controlled infrastructure to phishing frameworks, browser and system fingerprinting, use of cloud storage services to host malicious payloads, and delivery of malware through malicious document lures. Open-source reporting has also linked separate activity by the actor to malware delivery, including the SPICA backdoor. Beyond account compromise for intelligence collection, Star Blizzard has been associated with hack-and-leak activity in which stolen information was later exposed to shape political narratives. Public reporting has linked the actor to operations affecting UK politics and democratic processes, including targeting parliamentarians and politically sensitive institutions, and to campaigns against U.S. government-linked targets, defense-related entities, and research organizations. The actor has also been connected to phishing waves targeting messaging-platform users and high-risk communities, particularly where access to communications would yield military, political, or personal intelligence. Star Blizzard operates with persistent, target-aware tradecraft rather than broad indiscriminate malware distribution. Its campaigns frequently emphasize reconnaissance, relationship mapping, and exploitation of trust within professional or activist networks. This makes the actor particularly relevant to diplomatic, policy, defense, civil society, and opposition ecosystems where email and messaging account compromise can enable both intelligence collection and downstream influence operations.