Star Blizzard: threat actor profile

Star Blizzard is a cyber espionage and influence group originating in Russia that has been active since at least 2019. (MITRE ATT&CK, G1033)

Also known as: SEABORGIUM, Callisto Group, TA446, COLDRIVER

Attacks we reported

1. Sep 29, 2026 Microsoft says Star Blizzard uses RedFlick to deploy CosmicPulse

20 techniques MITRE has documented for this group

1. Reconnaissance Gather Victim Identity Information T1589 · Search Open Websites/Domains T1593 · Phishing for Information: Spearphishing Attachment T1598.002 · Phishing for Information: Spearphishing Link T1598.003
2. Resource Development Acquire Infrastructure T1583 · Acquire Infrastructure: Domains T1583.001 · Establish Accounts: Social Media Accounts T1585.001 · Establish Accounts: Email Accounts T1585.002 · Compromise Accounts: Email Accounts T1586.002 · Obtain Capabilities: Tool T1588.002 · Stage Capabilities: Upload Malware T1608.001
3. Initial Access Valid Accounts T1078 · Phishing: Spearphishing Attachment T1566.001
4. Execution Command and Scripting Interpreter: JavaScript T1059.007 · User Execution: Malicious File T1204.002
5. Persistence Valid Accounts T1078
6. Privilege Escalation Valid Accounts T1078
7. Stealth Valid Accounts T1078 · Social Engineering: Impersonation T1684.001
8. Credential Access Steal Web Session Cookie T1539
9. Lateral Movement Use Alternate Authentication Material: Web Session Cookie T1550.004
10. Collection Email Collection: Remote Email Collection T1114.002 · Email Collection: Email Forwarding Rule T1114.003

All threat actors · ATT&CK heatmap

MITRE ATT&CK® data © The MITRE Corporation, reproduced and distributed with the permission of The MITRE Corporation (Enterprise ATT&CK v20.0).