Actor Profile

Star Blizzard (also tracked as SEABORGIUM, Callisto Group, TA446, COLDRIVER) is a Russian state-sponsored threat actor attributed by U.S., U.K., Australian, Canadian, and New Zealand security agencies to Center 18 of Russia's Federal Security Service (FSB). The group specializes in credential theft and espionage operations, historically using spear-phishing and social engineering to impersonate trusted contacts. Since 2023, the actor has expanded its tradecraft to include fake conference and event invitations as lures, often engaging targets in multi-stage email conversations before delivering malicious payloads. The group's primary motivation is intelligence collection in support of Russian state interests, with a particular focus on entities involved in Ukraine policy and support.

TTPs (Tactics, Techniques, Procedures)

Star Blizzard employs a multi-stage infection chain leveraging social engineering and living-off-the-land techniques. Initial access is achieved via spear-phishing (T1566.001) using fake event invitations from compromised WordPress and cPanel sites (T1583.001). The group uses password-protected archives containing LNK files disguised as PDFs (T1204.002) that execute hidden commands to download MSI installers. Persistence is established through scheduled tasks (T1053.005) with names mimicking legitimate Windows components. The RedFlick technique deploys the Python-based CosmicPulse backdoor (T1059.006), which communicates with C2 infrastructure for command execution. The actor also conducts extensive reconnaissance (T1589), credential harvesting via phishing (T1598.002, T1598.003), and email collection (T1114.002, T1114.003). In at least one March 2026 campaign, the group pivoted to delivering the DarkSword iPhone exploit kit, demonstrating cross-platform capabilities.

Targets & Patterns

Star Blizzard primarily targets individuals and organizations with ties to Ukraine, including government bodies, NGOs, think tanks, and policy organizations focused on Ukraine support and recovery. The 2026 campaign affected over 100 organizations, predominantly in the United States and United Kingdom, with additional targeting in Ukraine itself. Specific lures impersonated prominent institutions such as Chatham House and the Atlantic Council. Ukrainian-focused campaigns included fake tax audit notices to Ukr.net users, water shutdown notices for Kyiv hotels, and payment notices for international financial organization staff. The targeting pattern reflects Russian intelligence priorities around Ukraine policy, diplomatic efforts, and civil society organizations involved in Ukraine's recovery and defense. The actor's long-term focus on credential theft suggests objectives include persistent access to email communications and intelligence gathering on Western policy positions regarding Ukraine.

Historical Context

Star Blizzard has conducted credential theft operations for years, historically relying on spear-phishing that impersonates known contacts to steal email passwords. By 2023, the group had adopted fake conference and event invitations as a primary lure, often engaging in extended email exchanges with targets before delivering malicious links. In 2025, the actor employed ClickFix techniques using fake CAPTCHA pages to trick users into executing commands. The 2026 campaigns represent an evolution to the RedFlick delivery method, utilizing scheduled tasks for persistence and the CosmicPulse backdoor. The group shifted infrastructure from free email services (Proton, Microsoft consumer accounts) to compromised WordPress and cPanel websites starting in March 2026. Microsoft identified at least 13 large-scale campaigns in 2026, marking a significant increase in operational tempo compared to the group's historically targeted approach. Infrastructure overlap (IP 103.160.59[.]97, domain secure-dns-hub[.]com) links these campaigns to a June 2026 operation reported by Digital Security Lab Ukraine targeting Ukrainian civil society with fake Ukraine Recovery Conference invitations.

Defensive Recommendations

  • Scrutinize sender email addresses in event invitations, verifying that the organization's domain appears after the @ sign rather than before it; independently verify invitations through known phone numbers or email addresses
  • Hunt for scheduled tasks named 'Internet Quality Test Connection', 'Network Configuration Manager', and 'System Health Monitor' which Star Blizzard uses for persistence (T1053.005)
  • Deploy Microsoft Defender detections for Trojan:Script/RedFlick and Backdoor:Python/CosmicPulse; enable attack surface reduction rules to block rare, new, or untrusted executables and obfuscated scripts
  • Block or strictly limit outbound SSH connections not required for business operations, as early campaign variants used SSH for payload retrieval (T1021.004)
  • Extend threat hunting queries beyond 7-day windows to at least 30 days or leverage SIEM retention (e.g., Microsoft Sentinel) to detect indicators dating to January 2026; monitor for LNK files disguised as PDFs and MSI installers fetched from remote servers

---

# Geopolitical Context

Geopolitical Context

The campaign reflects Russia's sustained intelligence collection priorities against Western policy communities engaged with Ukraine. Star Blizzard, assessed by Five Eyes agencies to operate under FSB Center 18, has evolved its tradecraft from credential harvesting to deploying persistent backdoors on target systems. The use of fake invitations from prominent think tanks—Chatham House, Atlantic Council—demonstrates sophisticated social engineering designed to exploit trust networks within foreign policy and defense circles. The timing, beginning in January 2026 and intensifying through September, coincides with ongoing Western support for Ukraine and suggests Russian intelligence requirements to monitor policy deliberations, donor coordination, and civil society networks. The targeting of Ukrainian civil society organizations alongside U.S. and U.K. entities indicates both tactical intelligence collection on Ukrainian resilience efforts and strategic monitoring of transatlantic Ukraine policy formulation.

State Actor Alignment

Star Blizzard is attributed by U.S., U.K., Australian, Canadian, and New Zealand security agencies to Russia's Federal Security Service (FSB) Center 18, with "almost certain" confidence as of December 2023. This attribution places the activity within Russia's domestic intelligence apparatus, which has expanded its remit to include foreign intelligence operations targeting perceived threats to Russian state interests. The group's focus on Ukraine-related targets aligns with broader Kremlin strategic objectives to undermine Western support for Kyiv and collect intelligence on sanctions policy, military assistance, and diplomatic initiatives. The campaign does not appear to be subject to new public sanctions designations, though Star Blizzard's FSB affiliation means its operations fall under existing sectoral measures against Russian intelligence services.

Business Impacty pro region

The campaign's concentration in the U.S. and U.K.—both leading providers of military and financial assistance to Ukraine—underscores Russian intelligence prioritization of Anglosphere policy networks. Targeting of think tanks and NGOs represents an effort to penetrate the "second track" diplomacy and policy development ecosystem that shapes government positions on Ukraine. For European allies, the activity signals continued Russian appetite for espionage against civil society and research institutions engaged in Ukraine reconstruction planning, sanctions enforcement analysis, and defense policy. The March variant delivering DarkSword, an iPhone exploit kit, to Atlantic Council-themed targets demonstrates capability diversification beyond Windows environments and willingness to deploy mobile device compromises against high-value individuals. Ukrainian civil society organizations face dual pressure: direct targeting via localized lures (tax notices, utility shutdowns) and indirect compromise through their Western partner networks. The campaign may degrade information sharing between Ukrainian and Western entities if trust in digital communications erodes.

Forecast

If Western governments maintain or increase support for Ukraine through 2026-2027, Star Blizzard is likely to sustain or expand operations against policy-adjacent targets, potentially broadening to European think tanks and multilateral institutions involved in reconstruction planning. The group's demonstrated ability to compromise legitimate websites for email infrastructure suggests future campaigns may leverage additional trusted platforms to evade detection. If the RedFlick and CosmicPulse toolset proves effective, other FSB-linked groups may adopt similar scheduled task persistence and Python-based backdoors, complicating attribution. Should targeted organizations implement recommended defenses—particularly sender verification and scheduled task monitoring—the group will likely revert to or refine earlier ClickFix social engineering methods that rely on user execution rather than automated delivery. If geopolitical tensions escalate around Ukraine negotiations or NATO posture, the tempo of Star Blizzard activity against diplomatic and policy communities is likely to increase, with potential for more aggressive data exfiltration or disruptive actions against compromised networks.