Star Blizzard

Star Blizzard is a Russian state-linked spear-phishing and cyber-espionage threat actor assessed by multiple Western governments to operate on behalf of the Russian Federal Security Service, specifically FSB Centre 18. The group is widely tracked under the aliases SEABORGIUM, COLDRIVER, Callisto Group, TA446, BlueCharlie, TAG-53, and related variants. It has been active since at least the mid-2010s and has conducted sustained information-gathering operations, including campaigns targeting democratic institutions and politically sensitive individuals in the United Kingdom and elsewhere. The actor primarily targets government and public-sector entities, defense organizations, academia, think tanks, NGOs, journalists, politicians, civil society groups, and individuals with expertise or involvement in Russian affairs, Ukraine, NATO, and Eastern Europe. Reported victim geography shows a strong concentration on the United Kingdom and United States, with additional targeting across other NATO countries, Ukraine, the Baltics, the Nordics, Eastern Europe, the Caucasus, and Russian and Belarusian opposition or exile communities. Star Blizzard is best known for highly tailored spear-phishing that relies on extensive reconnaissance of victims’ professional networks, interests, and trusted contacts. Operators commonly impersonate known associates, respected experts, or event organizers using fraudulent email and social-media personas, and often begin with benign conversation over an extended period to build rapport before delivering phishing content. The group frequently targets personal email accounts to evade enterprise defenses and has used lures themed around conferences, policy discussions, shared documents, and other contextually relevant subjects. Operationally, Star Blizzard has used credential-harvesting infrastructure that imitates legitimate sign-in workflows and has leveraged the EvilGinx adversary-in-the-middle framework to steal both credentials and authenticated web session cookies. This enables session hijacking and bypass of multi-factor authentication. After account compromise, the actor accesses victim mailboxes, steals emails and attachments, creates mail-forwarding rules for persistence and collection, harvests contact lists and mailing-list data, and uses compromised accounts to launch follow-on phishing against additional targets. The group has also been associated with hack-and-leak activity and politically motivated interference operations, including the selective disclosure of stolen material to sow distrust and influence public discourse. UK authorities publicly attributed a long-running campaign against British political figures and democratic institutions to officers of FSB Centre 18 and identified individuals linked to the operation, including Ruslan Peretyatko and Andrey Korinets. Star Blizzard has additionally been linked in reporting to phishing activity against Russian opposition figures abroad and to broader Russian intelligence efforts targeting secure messaging users for account access and intelligence collection. Star Blizzard’s dominant function is espionage in support of Russian state objectives, though some operations have blended intelligence collection with influence activity. The actor is adaptive and has repeatedly changed infrastructure and phishing tradecraft in response to public exposure while maintaining a consistent focus on social engineering, credential theft, session theft, and exploitation of trusted communications channels.