Actor Profile

Star Blizzard (also tracked as SEABORGIUM, Callisto Group, TA446, COLDRIVER) is a Russian state-sponsored threat actor attributed by CISA to the FSB Centre 18. The group conducts cyberespionage operations targeting Ukrainian individuals and institutions, international NGOs, Western think tanks, governments, and organizations associated with international policy—particularly those supporting Ukraine. Since January 2026, the actor has evolved their operational tradecraft to improve detection evasion, scale, and compromise success rates through large-scale phishing campaigns and novel malware delivery techniques.

TTPs (Tactics, Techniques, Procedures)

Star Blizzard employs a comprehensive set of TTPs mapped to MITRE ATT&CK including: T1566.001 (Spearphishing Attachment), T1598.002 (Spearphishing Link), T1598.003 (Spearphishing via Service), T1204.002 (Malicious File), T1608.001 (Upload Malware), T1583.001 (Domains), T1583 (Acquire Infrastructure), T1585.002 (Email Accounts), T1588.002 (Tool), T1114.002 (Remote Email Collection), T1114.003 (Email Forwarding Rule), T1550.004 (Web Session Cookie), T1539 (Steal Web Session Cookie), T1589 (Gather Victim Identity Information), and T1684.001. In 2026, the actor introduced RedFlick, a malware delivery technique using scheduled tasks to deploy the CosmicPulse backdoor with reduced user interaction compared to previous ClickFix-based chains. The group shifted from targeted spear-phishing to large-scale phishing campaigns (tens to hundreds of emails per wave) using compromised website accounts and mass-mailing platforms.

Targets & Patterns

Star Blizzard primarily targets Ukrainian individuals and institutions, international NGOs, Western think tanks, government officials, foreign policy practitioners, security researchers, academia, media organizations, and financial institutions—particularly those with a nexus in supporting Ukraine politically or financially. The 2026 RedFlick campaigns affected over 100 organizations primarily in the United States and United Kingdom, consistent with the actor's longstanding targeting priorities. Specific 2026 campaigns targeted Ukraine persons with tax-themed lures, government officials and security researchers with invitations to private roundtables (impersonating IISS, CES, Atlantic Council), and US/Europe technology-sector organizations. The shift to larger-scale operations suggests an attempt to expand the initial targeting pool and increase compromise likelihood while maintaining focus on policy, diplomatic, and Ukraine-related entities.

Historical Context

Star Blizzard periodically overhauls their TTPs to avoid detection, often in response to public exposure. Microsoft previously reported on the actor's 2023-2024 spear-phishing campaigns that relied on initiating email contact before sending malicious links for credential theft while impersonating political or diplomatic figures. Following Google Threat Intelligence Group's October 2025 report on Star Blizzard's COLDCOPY malware, Microsoft observed the actor refine their initial access and evasion techniques. The 2026 activity represents a notable shift from exclusively targeted spear-phishing to large-scale phishing operations—a scale not previously seen from this actor. The RedFlick technique also marks a departure from previous ClickFix-based infection chains, reducing required victim actions from multiple steps to a single interaction before CosmicPulse backdoor deployment.

Defensive Recommendations

  • Monitor for T1566.001 spearphishing attachments with Ukrainian tax-themed lures or invitations to policy roundtables impersonating legitimate organizations (IISS, Atlantic Council, CES)
  • Detect T1608.001 and scheduled task creation (T1053.005) associated with RedFlick malware delivery chains deploying CosmicPulse backdoor
  • Investigate email accounts created on compromised websites (T1585.002) used as sender infrastructure in mass-mailing phishing campaigns
  • Hunt for T1114.002/T1114.003 email collection and forwarding rule creation following successful credential theft operations
  • Monitor for T1539 and T1550.004 web session cookie theft and replay attacks against high-value targets in government, NGO, and think tank sectors

---

# Geopolitical Context

Geopolitical Context

Star Blizzard, attributed by US CISA to Russia's Federal Security Service (FSB) Centre 18, has demonstrated operational adaptation in response to public exposure of its campaigns. Since January 2026, the actor has shifted from targeted spear-phishing to large-scale phishing operations, representing a strategic recalibration likely aimed at improving operational efficiency and expanding compromise opportunities. The targeting pattern—Ukrainian individuals and institutions, alongside Western NGOs, think tanks, governments, and financial entities supporting Ukraine—is consistent with Russian intelligence priorities in the context of the ongoing conflict. The adoption of RedFlick, a streamlined malware delivery technique requiring only single-click user interaction, suggests the actor is prioritizing scalability and detection evasion over the precision of earlier campaigns. This evolution reflects broader Russian cyber doctrine emphasizing persistent access to policy-shaping institutions and Ukraine's support network, while adapting tradecraft in response to defensive improvements and public attribution.

State Actor Alignment

Star Blizzard is formally attributed by the United States Cybersecurity and Infrastructure Agency (CISA) as subordinate to the Russian Federal Security Service (FSB) Centre 18. The actor's 2026 campaigns appear consistent with Russian state intelligence collection priorities, focusing on Ukrainian targets and Western entities with policy or financial ties to Ukraine. The operational shift toward mass phishing and novel evasion techniques follows public reporting by Google Threat Intelligence Group in October 2025 on the actor's COLDCOPY malware, suggesting adaptive responses to exposure. Over 100 organizations, primarily in the United States and United Kingdom, have been affected—a targeting profile aligned with longstanding FSB intelligence requirements related to foreign policy, defense, and Ukraine support networks. Microsoft has directly notified affected customers in accordance with its nation-state notification protocols.

Business Impacty pro region

The campaign's geographic and sectoral focus carries significant implications for transatlantic security cooperation. The concentration of targeting on US and UK organizations—particularly think tanks, NGOs, and government entities engaged in Ukraine policy—suggests an intent to penetrate deliberative spaces shaping Western support for Kyiv. European institutions, including those convening closed-door discussions on European security (as evidenced by phishing lures impersonating IISS and Atlantic Council events), represent high-value intelligence targets for Russian services seeking insight into coalition cohesion and policy trajectories. The targeting of Ukrainian financial and governmental institutions directly supports Russian operational objectives within the theater of conflict. For NATO allies and EU member states, the campaign underscores persistent Russian cyber espionage against the policy and civil society infrastructure underpinning collective defense and sanctions regimes. The scale and automation of these operations may indicate resource reallocation or tactical experimentation by FSB cyber units, with potential spillover risks to adjacent sectors in targeted regions.

Forecast

If Star Blizzard continues to refine RedFlick and expand mass-phishing infrastructure, organizations in the Ukraine policy ecosystem are likely to face sustained intrusion attempts with improved evasion characteristics. Should public or private sector defenses successfully detect and disrupt RedFlick campaigns, the actor is likely to iterate on delivery mechanisms or revert to more targeted spear-phishing, consistent with historical patterns of tactical adaptation following exposure. If geopolitical tensions surrounding Ukraine remain elevated or escalate, FSB-linked actors may intensify targeting of Western policy institutions to support strategic intelligence requirements. Organizations that implement robust email authentication, endpoint detection, and user awareness training are more likely to mitigate the single-interaction compromise vector that RedFlick exploits. Conversely, entities with limited visibility into scheduled task creation and malware staging behaviors may remain vulnerable to CosmicPulse deployment even if initial phishing lures are identified.