Loading story…
The UK government publicly attributed a long-running cyber campaign against democratic institutions and politicians’ personal email accounts to officers of Centre 18 of Russia’s FSB, identifying the activity under names including COLDRIVER, Star Blizzard, SEABORGIUM, Callisto, and BlueCharlie. Officials said the operation had run since at least 2015, included the compromise of then trade minister Liam Fox’s email in 2019, and involved the selective leaking of stolen material later cited during a UK election campaign. In response, London summoned the Russian ambassador and sanctioned Ruslan Peretyatko and Andrew Korinets following a National Crime Agency investigation.
Security researchers said the group has continued refining its credential-harvesting tradecraft to evade detection, replacing exposed infrastructure with dozens of new domains and using legitimate cloud services such as Google Docs and Microsoft OneDrive as phishing lures. Prior reporting linked the actor to Evilginx-based phishing kits designed to steal credentials and MFA tokens, with targets spanning governments, defense organizations, think tanks, NGOs, journalists, and academic institutions across Europe and North America. Microsoft warned that the actor’s ongoing attacks show increased sophistication and evasion, underscoring that the campaign remains active despite public exposure and sanctions.
TTPs, infrastructure, and targeting history in one profile.
14 events from the most recent confirmed update back to the earliest known activity.
A joint advisory from the UK, US, Australia, Canada, and New Zealand said Star Blizzard continued spear-phishing through 2023 and described its use of EvilGinx to steal credentials and session cookies, bypass MFA, and set mail-forwarding rules in compromised email accounts. The advisory also said the actor had targeted academia, defense, government, NGOs, think tanks, and politicians since 2019, with activity expanding during 2022 to defense-industrial targets and US Department of Energy facilities.
Microsoft published a blog post warning that Star Blizzard continues to refine its tradecraft to evade detection and increase sophistication in ongoing attacks. The post was cited alongside the UK attribution announcement.
The United Kingdom added Ruslan Peretyatko and Andrew Korinets to its Cyber Sanctions list in connection with the campaign. The National Crime Agency said the sanctions followed a lengthy and complex investigation.
The British government publicly attributed the long-running campaign against UK democratic institutions and personal email accounts to officers of Centre 18 of Russia’s FSB. Officials said the Russian ambassador was summoned and described the operation as sustained but unsuccessful.
Microsoft announced it had disrupted ongoing SEABORGIUM phishing operations and published details about the actor’s credential-theft activity. The action marked a separate vendor-led disruption effort against infrastructure used by the group.
Google TAG said COLDRIVER continued credential-phishing against government, defense, NGO, and media targets using links in emails and cloud-hosted lure documents. TAG also said Google Safe Browsing blocked COLDRIVER phishing domains and published indicators tied to the campaign.
A website called “Very English Coop d’Etat” appeared and purported to reveal a Brexit-related plot. Google TAG later told Reuters it had technically linked the site to CALISTO operations, while Sekoia.io said similarities to earlier hack-and-leak campaigns were weak.
Google TAG published indicators of compromise and linked CALISTO/COLDRIVER to spear-phishing campaigns against Western NGOs, think tanks, and defense-sector targets. The reporting described the actor’s use of freshly created Gmail accounts and cloud-hosted lure documents to route victims to phishing domains.
The UK said the FSB-linked group targeted then trade minister Liam Fox’s email account in 2019. Stolen material was selectively leaked and later cited by Jeremy Corbyn during the UK election campaign.
ANSSI reported a large spearphishing and phishing campaign targeting government, diplomatic, think tank, and other strategic organizations, with traces dating back to 2017. The report documented malicious infrastructure and noted open-source technical links to activity associated with Kimsuky and Group123, without making a formal attribution.
The UK said a sustained cyber campaign targeting the personal email accounts of hundreds of people in Britain, including politicians from multiple parties, has been active since 2015. The activity was later linked by the UK to officers of FSB Centre 18 and the group tracked as Callisto/COLDRIVER/Star Blizzard/SEABORGIUM.
Recorded Future’s Insikt Group reported that TAG-53 was conducting phishing and likely credential-harvesting operations and assessed overlaps with Callisto Group, COLDRIVER, and SEABORGIUM. Researchers identified infrastructure impersonating organizations including Global Ordnance, UMO Poland, the Commission for International Justice and Accountability, Blue Sky Network, DTGruelle, and Russia’s Ministry of Internal Affairs, and observed a spoofed Microsoft login page on drive-globalordnance[.]com.
Recorded Future reported that BlueCharlie, also known as Calisto/COLDRIVER/SEABORGIUM/StarBlizzard, replaced previously exposed infrastructure with 94 new domains for credential harvesting and follow-on espionage. Researchers assessed the change was likely a response to public exposure of the group’s earlier tactics and infrastructure.
Sekoia.io published analysis of CALISTO’s credential-harvesting infrastructure, identifying 24 Evilginx-enabled domains with medium to high confidence and a likely low-confidence phishing domain targeting the Ukrainian Ministry of Defense. The report also described operator OPSEC mistakes, including default redirects to a Rickroll video and The New York Times homepage, that helped uncover additional servers.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 73 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
11 references tracked. Mallory keeps watching after this page renders.
blog.knowbe4.com
Open sourcesocradar.io
Open sourcencsc.gov.uk
Open sourcetherecord.media
Open sourceblog.google
Open sourceblog.sekoia.io
Open sourcecert.ssi.gouv.fr
Open sourcerecordedfuture.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Citizen Lab and Access Now documented a sophisticated spear-phishing campaign targeting Russian opposition figures, Belarusian and Russian civil society groups, independent media, international NGOs active in Eastern Europe, policy experts, funders, journalists, and at least one former U.S. ambassador. Researchers attributed one cluster to **COLDRIVER**—also tracked as **Star Blizzard**, **Callisto**, **TA446**, **Blue Charlie**, and **UNC4057**—a Russia-linked threat actor that multiple governments have associated with the FSB’s Centre 18, while identifying a separate but related phishing cluster as **COLDWASTREL**. The operations used highly personalized impersonation emails sent from compromised or lookalike accounts, along with fake encrypted or protected PDF lures that redirected victims through fingerprinting infrastructure to credential-harvesting pages spoofing services such as Gmail and ProtonMail. Investigators found overlaps with known COLDRIVER tradecraft, including Hostinger-registered domains, Let’s Encrypt or ZeroSSL certificates, LibreOffice 7.0 PDF metadata, randomized author names, and occasional HubSpot links, while COLDWASTREL showed distinct metadata, infrastructure, and domain patterns. The groups sought passwords, two-factor authentication codes, and session cookies, raising the risk of exposing sensitive identities, communications, relationships, and locations of organizations already facing Russian government repression.
Jul 12, 2026
The UK National Cyber Security Centre, FBI, NSA, and CISA warned that Russia’s Foreign Intelligence Service (**SVR**), also tracked as **APT29** and **Nobelium**, is running a broad cyber-espionage campaign that combines mass exploitation of known vulnerabilities with targeted intrusions against governments, diplomats, think tanks, technology firms, financial institutions, and cloud environments. Officials said the group scans the internet for unpatched systems and exploits long-known perimeter flaws including `CVE-2019-19781`, `CVE-2019-11510`, `CVE-2018-13379`, and `CVE-2020-5902`, then uses compromised accounts to move deeper into victim networks and, in some cases, into connected supply chains. The campaign builds on tradecraft previously tied to the **SolarWinds Orion** compromise and later phishing and cloud-focused operations attributed to the SVR. U.S. and allied advisories said the service has shifted toward stealthier methods such as password spraying, abuse of mailbox and cloud permissions, temporary email infrastructure, and reduced reliance on custom malware, though earlier operations also used tools such as **SUNBURST**, **TEARDROP**, **Cobalt Strike Beacon**, and **WELLMESS**. Microsoft separately reported that Nobelium targeted thousands of accounts across hundreds of organizations in a focused espionage effort, while defenders were urged to prioritize patching internet-facing systems, enforce multi-factor authentication, audit identity and mailbox permissions, and investigate signs of lateral movement and account abuse.
Aug 15, 2026
The Russian state-linked advanced persistent threat group COLDRIVER, also known as Star Blizzard, Callisto, and UNC4057, has expanded its cyber-espionage toolkit by launching a new campaign utilizing novel malware payloads. In this operation, COLDRIVER has introduced the BAITSWITCH and SIMPLEFIX payloads, which are delivered through a ClickFix-like campaign targeting individuals and organizations associated with civil society, NGOs, human rights defenders, and think tanks, particularly those with connections to Russia or residing in Western regions. The campaign employs malicious CAPTCHA checks to deceive victims into executing the BAITSWITCH DLL via the Windows Run dialog box. Once executed, BAITSWITCH retrieves the SIMPLEFIX payload, which enables the execution of PowerShell scripts, commands, and remote binaries hosted on external URLs, thereby granting attackers significant control over compromised systems. Security researchers from Zscaler ThreatLabz have highlighted that this campaign closely aligns with COLDRIVER’s established victimology, focusing on entities critical of or exiled from Russia. The use of these new malware strains demonstrates COLDRIVER’s ongoing efforts to update and diversify its attack arsenal, making detection and mitigation more challenging for defenders. The campaign’s technical sophistication is evident in its use of social engineering tactics, such as fake CAPTCHA prompts, to bypass user suspicion and security controls. The deployment of BAITSWITCH and SIMPLEFIX represents a notable evolution from previous COLDRIVER operations, which relied on more traditional phishing and malware delivery methods. The campaign’s infrastructure allows for flexible payload delivery, enabling attackers to adapt their tactics based on the target’s environment. Security analysts have warned that the campaign’s focus on civil society organizations increases the risk of sensitive information theft and potential disruption of advocacy activities. The operation’s timing coincides with heightened geopolitical tensions, further raising concerns about the potential for state-sponsored cyber-espionage to influence international affairs. Defensive recommendations include heightened vigilance for suspicious CAPTCHA prompts, monitoring for unusual DLL executions, and restricting PowerShell and remote binary execution where possible. The campaign underscores the persistent threat posed by Russian APT groups to Western civil society and the need for robust security awareness and technical controls. Organizations are advised to review their security postures and update detection mechanisms to identify the new BAITSWITCH and SIMPLEFIX payloads. The ongoing evolution of COLDRIVER’s tactics highlights the importance of continuous threat intelligence sharing and collaboration among targeted sectors. Security vendors and researchers continue to monitor the campaign for further developments and potential expansion of targeting. The incident serves as a reminder of the sophisticated and adaptive nature of state-linked cyber-espionage operations.
Jun 29, 2026