Star Blizzard

Star Blizzard is a Russia-based cyber espionage threat actor publicly linked by multiple governments to the Russian Federal Security Service (FSB), commonly described as subordinate to the FSB and in some reporting associated with Centre 18. It is widely tracked under aliases including COLDRIVER, Callisto, Seaborgium, TA446, BlueCharlie, Gossamer Bear, and UNC4057. The group is known primarily for highly targeted spearphishing and credential theft operations against high-value individuals and organizations. Its victims have included government personnel, former intelligence and military officers, defense-related targets, journalists, think tanks, universities, nongovernmental organizations, civil society groups, Russian and Belarusian opposition figures, independent media, and policy experts. Public reporting also links the actor to interference in UK politics and democratic processes, including operations involving politically sensitive document theft and subsequent leaks. Star Blizzard’s tradecraft centers on tailored social engineering. It commonly impersonates trusted contacts, subject-matter experts, colleagues, funders, or affiliated organizations using spoofed or lookalike email accounts. Campaigns have used fake protected or encrypted PDF lures, credential-harvesting pages masquerading as legitimate webmail providers, and adversary-in-the-middle phishing infrastructure associated with Evilginx to capture passwords, two-factor authentication codes, and session cookies. The actor has also used JavaScript-based redirection and browser fingerprinting in phishing chains, uploaded malicious payloads to cloud storage services, and delivered malware through malicious PDF lures in some operations. Separate reporting ties similar Russian messaging-app phishing activity against Signal and WhatsApp users to Star Blizzard, including theft of credentials and account recovery material for intelligence collection. The actor’s operations are predominantly espionage-driven, focused on obtaining persistent access to email and messaging accounts and exfiltrating sensitive political, diplomatic, military, and personal information. Information stolen by the group has also been used in hack-and-leak activity to shape narratives and exacerbate political divisions, including activity affecting the United Kingdom. Public sanctions and indictments have identified individuals allegedly associated with the group as participants in long-running spearphishing campaigns supporting Kremlin policy objectives. Star Blizzard is best characterized as an FSB-linked Russian cyber espionage actor specializing in personalized phishing, account compromise, and information theft against governments, NATO-aligned interests, civil society, and critics of the Russian state.