Seaborgium

Seaborgium, also known by various names such as Star Blizzard, Callisto Group, COLDRIVER, and TAG-53, is a threat actor believed to be linked to Russia's Federal Security Service (FSB). The group has been active since at least 2015, targeting government officials, military personnel, journalists, and think tanks with a sophisticated spear-phishing campaign. Notably, this group was responsible for a nearly decade-long spear-phishing operation against British lawmakers across multiple political parties, resulting in the leak of classified documents. On August 15, 2022, Microsoft, Google’s Threat Analysis Group, and Proofpoint’s Threat Research Team collectively published a report detailing Seaborgium's phishing operations. Insikt Group used intelligence from open-source reporting to profile the infrastructure used by TAG-53, which bears significant overlap with public reporting on Callisto Group, COLDRIVER, and SEABORGIUM. The group's consistent setup of its infrastructure has been identified as a hallmark of their operations. In an effort to combat this cyber espionage, the U.S. Department of Justice and Microsoft's Digital Crimes Unit disrupted a spear-phishing campaign orchestrated by Star Blizzard, seizing a total of 107 internet domains linked to the group. This action followed the unsealing of a warrant to seize 41 domains used by the Russia-linked Callisto Group for computer fraud in the United States. Despite these measures, the threat actor continues to successfully execute spear-phishing attacks against targeted organizations and individuals in the UK and other regions.