Star Blizzard

Star Blizzard, a threat actor group with ties to Russia's FSB, has been conducting sophisticated spear-phishing campaigns predominantly targeting Western think tanks, government officials, defense contractors, journalists, and nongovernmental organizations (NGOs). The group uses spear-phishing techniques, registering domains to host their phishing framework and creating consumer email accounts that match the names of individuals they impersonate. They have been observed using compromised victim email accounts to conduct further spear-phishing activity against contacts of the original victims. Between January 2023 and August 2024, Microsoft noted that Star Blizzard targeted over 30 civil society entities and organizations in an attempt to exfiltrate sensitive information and interfere in their activities. The group's operations were significantly disrupted when Microsoft filed a civil action to seize 66 internet domains used by Star Blizzard, formerly known as SEABORGIUM and also referred to as COLDRIVER or Callisto Group. This action was hailed as a significant step in protecting the internet from such threats, although it is acknowledged to be only scratching the surface of the issue. Despite this setback, Star Blizzard is expected to continually establish new infrastructure for its operations, posing a persistent threat to technology-dependent societies. The Department of Justice (DoJ) revealed in a partially unsealed indictment that two FSB officers, Ruslan Peretyatko and Andrey Korinets, were charged for their involvement in the Star Blizzard espionage campaigns which extended to the UK, NATO countries, and Ukraine. With Star Blizzard's status as a tool for advancing Russian interests, including election disruption, the actions taken against them are seen as directly impacting efforts to protect democratic processes from external threats. However, experts anticipate a dramatic increase in nation-state backed groups purchasing domains for cyberespionage, seeding misinformation and disinformation, indicating that the combined DoJ/Microsoft action might just be a drop in the ocean.