Threat intelligence / Group

Star Blizzard

[Star Blizzard](https://attack.mitre.org/groups/G1033) is a cyber espionage and influence group originating in Russia that has been active since at least 2019. [Star Blizzard](https://attack.mitre.org/groups/G1033) campaigns align closely with Russian state interests and have included persistent phishing and credential theft against academic, defense, government, NGO, and think tank organizations in NATO countries, particularly the US and the UK.(Citation: Microsoft Star Blizzard August 2022)(Citation: CISA Star Blizzard Advisory December 2023)(Citation: StarBlizzard)(Citation: Google TAG COLDRIVER January 2024)

Group

TypeGroup

External ID—

First seen2026-08-14

Last seen2026-08-14

Confidence

—

[Star Blizzard](https://attack.mitre.org/groups/G1033) is a cyber espionage and influence group originating in Russia that has been active since at least 2019. [Star Blizzard](https://attack.mitre.org/groups/G1033) campaigns align closely with Russian state interests and have included persistent phishing and credential theft against academic, defense, government, NGO, and think tank organizations in NATO countries, particularly the US and the UK.(Citation: Microsoft Star Blizzard August 2022)(Citation: CISA Star Blizzard Advisory December 2023)(Citation: StarBlizzard)(Citation: Google TAG COLDRIVER January 2024)

21 recorded

Relationships

uses

to Acquire Infrastructure

Technique

uses

Technique

uses

to Email Accounts

Technique

uses

to Email Accounts

Technique

uses

to Email Forwarding Rule

Technique

uses

to Gather Victim Identity Information

Technique

uses

to Impersonation

Technique

uses

Technique

uses

to Malicious File

Technique

uses

to Remote Email Collection

Technique

uses

to Search Open Websites/Domains

Technique

uses

to Social Media Accounts

Technique

uses

to Spearphishing Attachment

Technique

uses

to Spearphishing Attachment

Technique

uses

to Spearphishing Link

Technique

uses

Malware

uses

to Steal Web Session Cookie

Technique

uses

Technique

uses

to Upload Malware

Technique

uses

to Valid Accounts

Technique

uses

to Web Session Cookie

Technique

9 external

References

mitre-attack

G1033

Callisto Group

—

TA446

—

COLDRIVER

—

SEABORGIUM

—

CISA Star Blizzard Advisory December 2023

https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-341a

Microsoft Star Blizzard August 2022

https://www.microsoft.com/en-us/security/blog/2022/08/15/disrupting-seaborgiums-ongoing-phishing-operations/

StarBlizzard

https://www.microsoft.com/en-us/security/blog/2023/12/07/star-blizzard-increases-sophistication-and-evasion-in-ongoing-attacks/

Google TAG COLDRIVER January 2024

https://blog.google/threat-analysis-group/google-tag-coldriver-russian-phishing-malware/