Star Blizzard is a cyber espionage and influence group originating in Russia that has been active since at least 2019. Star Blizzard campaigns align closely with Russian state interests and have included persistent phishing and credential theft against academic, defense, government, NGO, and think tank organizations in NATO countries, particularly the US and the UK.1234
- Microsoft Star Blizzard August 2022
- CISA Star Blizzard Advisory December 2023
- StarBlizzard
- Google TAG COLDRIVER January 2024
Claims and citations
Every claim comes from a writer; provenance is the writer's assertion, not a review verdict from this directory. Validity reads by citation year.
| predicate | object | Valid | Conf. | Evidence |
|---|---|---|---|---|
| uses_technique | tech_t1684.001 | 2024 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1583.001 | 2024 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1114.002 | 2024 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1550.004 | 2024 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1204.002 | 2024 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1608.001 | 2024 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1539 | 2024 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1589 | 2024 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1585.002 | 2024 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1566.001 | 2024 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1598.002 | 2024 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1598.003 | 2024 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1588.002 | 2024 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1583 | 2024 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1114.003 | 2024 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1585.001 | 2024 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1078 | 2024 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1586.002 | 2024 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1059.007 | 2024 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1593 | 2024 → … | 100 | src_mitre_attck_enterprise |
Technique use
| ATT&CK | Technique | platforms |
|---|---|---|
| T1059.007 | JavaScript | — |
| T1078 | Valid Accounts | — |
| T1114.002 | Remote Email Collection | — |
| T1114.003 | Email Forwarding Rule | — |
| T1204.002 | Malicious File | — |
| T1539 | Steal Web Session Cookie | — |
| T1550.004 | Web Session Cookie | — |
| T1566.001 | Spearphishing Attachment | — |
| T1583 | Acquire Infrastructure | — |
| T1583.001 | Domains | — |
| T1585.001 | Social Media Accounts | — |
| T1585.002 | Email Accounts | — |
| T1586.002 | Email Accounts | — |
| T1588.002 | Tool | — |
| T1589 | Gather Victim Identity Information | — |
| T1593 | Search Open Websites/Domains | — |
| T1598.002 | Spearphishing Attachment | — |
| T1598.003 | Spearphishing Link | — |
| T1608.001 | Upload Malware | — |
| T1684.001 | Impersonation | — |
Aliases
Callisto Group · COLDRIVER · SEABORGIUM · Star Blizzard · TA446
Reading and review
Records are auto-ingested and not human-reviewed. Confidence is the writer's 0–100 value; bands split at ≥80 / 50–79 / <50 into high / medium / low. The four trust axes (synthetic, lifecycle, band, source count) stay separate and never merge into one score.