Star Blizzard
- ID
- G1033
- Associated names
- SEABORGIUM, Callisto Group, TA446, COLDRIVER
- Source
- attack.mitre.org
- MITRE last modified
- 1 Aug 2026
Star Blizzard is a cyber espionage and influence group originating in Russia that has been active since at least 2019. Star Blizzard campaigns align closely with Russian state interests and have included persistent phishing and credential theft against academic, defense, government, NGO, and think tank organizations in NATO countries, particularly the US and the UK.[1][2][3][4]
Techniques used (20)
- T1059.007 JavaScript
- T1078 Valid Accounts
- T1114.002 Remote Email Collection
- T1114.003 Email Forwarding Rule
- T1204.002 Malicious File
- T1539 Steal Web Session Cookie
- T1550.004 Web Session Cookie
- T1566.001 Spearphishing Attachment
- T1583 Acquire Infrastructure
- T1583.001 Domains
- T1585.001 Social Media Accounts
- T1585.002 Email Accounts
- T1586.002 Email Accounts
- T1588.002 Tool
- T1589 Gather Victim Identity Information
- T1593 Search Open Websites/Domains
- T1598.002 Spearphishing Attachment
- T1598.003 Spearphishing Link
- T1608.001 Upload Malware
- T1684.001 Impersonation