Star Blizzard

Overview

Star Blizzard is a cyber espionage and influence group originating in Russia that has been active since at least 2019. Star Blizzard campaigns align closely with Russian state interests and have included persistent phishing and credential theft against academic, defense, government, NGO, and think tank organizations in NATO countries, particularly the US and the UK.

Naming & attribution

Star Blizzard is tracked under 5 names across the industry. It uses 20 documented ATT&CK techniques — more than 53% of the 174 groups tracked here. Activity attributed since at least 2019.

Distinctive techniques

Techniques this group uses that are rare across the other 173 tracked groups — these carry more signal than the near-universal ones.

• T1550.004 Web Session Cookie — used by 1 of 174 groups

Closest groups by technique overlap

Computed from shared ATT&CK techniques. Overlap is not attribution — distinct actors converge on the same tradecraft — but a high share is a useful pivot.

• IndigoZebra China — 5 shared techniques (23% overlap)
• Silent Librarian — 6 shared techniques (22% overlap)
• EXOTIC LILY — 6 shared techniques (21% overlap)
• APT-C-36 — 9 shared techniques (18% overlap)
• WIRTE — 7 shared techniques (18% overlap)
• CURIUM Iran — 6 shared techniques (18% overlap)

Targets

Government · Journalists · Military · Think Tanks

TTPs — 20 techniques across 8 tactics

Tools & malware (1)

Spica

Reporting (3)

• Russian threat group COLDRIVER expands its targeting of Western officials to include the use of malware — Shields, W
• Russian FSB Cyber Actor Star Blizzard Continues Worldwide Spear-phishing Campaigns — CISA, et al
• Star Blizzard increases sophistication and evasion in ongoing attacks — Microsoft Threat Intelligence