自动化接入 · API / MCP EN

组织档案 · G1033

Star Blizzard

Star Blizzard is a cyber espionage and influence group originating in Russia that has been active since at least 2019. Star Blizzard campaigns align closely with Russian state interests and have included persistent phishing and credential theft against academic, defense, government, NGO, and think tank organizations in NATO countries, particularly the US and the UK.

ATT&CK G1033 置信带 高 · 100 来源 src_mitre_attck_enterprise 状态 active
全部2024

Star Blizzard is a cyber espionage and influence group originating in Russia that has been active since at least 2019. Star Blizzard campaigns align closely with Russian state interests and have included persistent phishing and credential theft against academic, defense, government, NGO, and think tank organizations in NATO countries, particularly the US and the UK.1234

  1. Microsoft Star Blizzard August 2022
  2. CISA Star Blizzard Advisory December 2023
  3. StarBlizzard
  4. Google TAG COLDRIVER January 2024

断言与引用

每条断言来自写入方；provenance 是写入方声称，不是本目录的复核结论。有效期按引用年份读取。

predicateobject有效期置信证据
also_known_asStar Blizzard— → …100src_mitre_attck_enterprise
also_known_asSEABORGIUM— → …100src_mitre_attck_enterprise
also_known_asCallisto Group— → …100src_mitre_attck_enterprise
also_known_asTA446— → …100src_mitre_attck_enterprise
also_known_asCOLDRIVER— → …100src_mitre_attck_enterprise
uses_techniquetech_t1684.0012024 → …100src_mitre_attck_enterprise
uses_techniquetech_t1583.0012024 → …100src_mitre_attck_enterprise
uses_techniquetech_t1114.0022024 → …100src_mitre_attck_enterprise
uses_techniquetech_t1550.0042024 → …100src_mitre_attck_enterprise
uses_techniquetech_t1204.0022024 → …100src_mitre_attck_enterprise
uses_techniquetech_t1608.0012024 → …100src_mitre_attck_enterprise
uses_techniquetech_t15392024 → …100src_mitre_attck_enterprise
uses_techniquetech_t15892024 → …100src_mitre_attck_enterprise
uses_techniquetech_t1585.0022024 → …100src_mitre_attck_enterprise
uses_techniquetech_t1566.0012024 → …100src_mitre_attck_enterprise
uses_techniquetech_t1598.0022024 → …100src_mitre_attck_enterprise
uses_techniquetech_t1598.0032024 → …100src_mitre_attck_enterprise
uses_techniquetech_t1588.0022024 → …100src_mitre_attck_enterprise
uses_techniquetech_t15832024 → …100src_mitre_attck_enterprise
uses_techniquetech_t1114.0032024 → …100src_mitre_attck_enterprise
uses_techniquetech_t1585.0012024 → …100src_mitre_attck_enterprise
uses_techniquetech_t10782024 → …100src_mitre_attck_enterprise
uses_techniquetech_t1586.0022024 → …100src_mitre_attck_enterprise
uses_techniquetech_t1059.0072024 → …100src_mitre_attck_enterprise
uses_techniquetech_t15932024 → …100src_mitre_attck_enterprise

技术使用

ATT&CK技术platforms
T1059.007JavaScript—
T1078Valid Accounts—
T1114.002Remote Email Collection—
T1114.003Email Forwarding Rule—
T1204.002Malicious File—
T1539Steal Web Session Cookie—
T1550.004Web Session Cookie—
T1566.001Spearphishing Attachment—
T1583Acquire Infrastructure—
T1583.001Domains—
T1585.001Social Media Accounts—
T1585.002Email Accounts—
T1586.002Email Accounts—
T1588.002Tool—
T1589Gather Victim Identity Information—
T1593Search Open Websites/Domains—
T1598.002Spearphishing Attachment—
T1598.003Spearphishing Link—
T1608.001Upload Malware—
T1684.001Impersonation—

别名

Callisto Group · COLDRIVER · SEABORGIUM · Star Blizzard · TA446

读取与复核

记录自动入库·未人工复核。置信度是写入方给出的 0–100 值，置信带按 ≥80 / 50–79 / <50 划为高 / 中 / 低；四条信任轴（合成、生命周期、置信带、佐证源数）分开呈现，不合并为单一信任分。

纠错