Actor Profile

Star Blizzard (also tracked as SEABORGIUM, Callisto Group, TA446, COLDRIVER) is a Russian state-sponsored threat actor active since 2017. The group is attributed to Russian intelligence services and is motivated by espionage objectives aligned with Russian state interests. Star Blizzard is characterized by continuous tactical evolution, regularly exploring novel payload delivery mechanisms including ClickFix social engineering and WhatsApp-based lures, and developing new malware families to support intelligence collection operations against geopolitical targets.

TTPs (Tactics, Techniques, Procedures)

Star Blizzard leverages a comprehensive set of MITRE ATT&CK techniques spanning the attack lifecycle. Initial access is achieved through spearphishing with attachments (T1566.001) and phishing for information via spearphishing service (T1598.002) and link (T1598.003). The group acquires infrastructure (T1583, T1583.001) and tools (T1588.002), stages capabilities via upload malware (T1608.001), and uses compromised accounts (T1586.001) and email accounts (T1585.002). Execution occurs via malicious file (T1204.002). Persistence and privilege escalation employ event-triggered execution via cloud storage synchronization (T1684.001). Credential access includes web session cookies (T1539) and web service session cookies (T1550.004). Collection focuses on email via remote email collection (T1114.002) and email forwarding rules (T1114.003). Reconnaissance includes gathering victim identity information (T1589). The RedFlick technique chains LNK execution, MSI installers, scheduled tasks, WebDAV preparation, and Control Panel applet (.cpl) downloaders to deploy the CosmicPulse Python-based backdoor.

Targets & Patterns

Star Blizzard primarily targets entities with geopolitical relevance to Russian intelligence priorities. The RedFlick campaigns observed in 2026 focused on Ukrainian individuals and institutions, as well as international NGOs, think tanks, government organizations, and financial institutions that have provided political or financial support to Ukraine. Microsoft identified at least 13 large-scale phishing campaigns since early 2026 impacting over 100 organizations, with concentration in the United States and United Kingdom. The targeting pattern reflects Russia's strategic interest in monitoring and potentially disrupting Western support for Ukraine, as well as intelligence collection against policy-making entities. The actor continues to rely on social engineering via impersonation of trusted contacts or organizations, delivered through free email providers.

Historical Context

Star Blizzard has demonstrated consistent operational evolution since its emergence in 2017. The group previously employed ClickFix techniques requiring multiple manual victim actions and experimented with WhatsApp-based delivery mechanisms. The RedFlick technique represents a tactical advancement toward automation and reduced victim interaction—requiring only a single click on a malicious LNK file versus multiple manual steps in ClickFix campaigns. The CosmicPulse backdoor deployed via RedFlick maintains capabilities consistent with those documented by Google in October 2025, including execution of attacker-supplied Python code, file download/execution, and document exfiltration. Microsoft's 2026 reporting indicates the group has expanded phishing operations and streamlined malware delivery infrastructure. Star Blizzard's known malware arsenal includes Spica (per MITRE ATT&CK data), and the group continues to develop new families like CosmicPulse to support ongoing operations.

Defensive Recommendations

  • Deploy phishing-resistant authentication (e.g., FIDO2 hardware tokens) and Conditional Access policies to prevent credential compromise even if users interact with phishing content
  • Block execution of LNK files from mounted VHDX/VHD virtual disk images via Group Policy or ASR rules; monitor Event ID 4663 for VHDX mount operations
  • Detect suspicious scheduled task creation (T1053.005) via Sysmon Event ID 1 and Windows Event ID 4698, especially tasks with names mimicking system maintenance components or executing control.exe with remote resources
  • Monitor and restrict WebDAV client usage via network controls; alert on net.exe or sc.exe commands enabling WebClient service outside of approved workflows
  • Enable EDR solutions in block mode to prevent execution of malicious MSI installers and Control Panel applets (.cpl files); hunt for cpl execution via control.exe from non-standard paths
  • Implement email security controls to quarantine password-protected archives and independently verify unexpected file-sharing messages through established out-of-band contact methods

---

# Geopolitical Context

Geopolitical Context

Star Blizzard, a Russian state-sponsored threat actor active since 2017, has introduced the RedFlick malware installation technique to deploy its CosmicPulse backdoor with reduced victim interaction. The group's operational evolution reflects a broader pattern of Russian cyber operations adapting delivery mechanisms to evade detection while maintaining strategic targeting priorities. Since early 2026, at least 13 large-scale phishing campaigns have impacted over 100 organizations, predominantly in the United States and United Kingdom. The targeting pattern—focused on Ukrainian individuals and institutions, as well as international NGOs, think tanks, governments, and financial institutions supporting Ukraine—is consistent with Russia's strategic interest in intelligence collection against entities involved in Ukraine policy and support networks. This activity occurs within the context of sustained Russian cyber operations against Western institutions and Ukraine-aligned actors.

State Actor Alignment

Star Blizzard is attributed by Microsoft to Russian state sponsorship. The group's targeting priorities align closely with Russian strategic intelligence requirements, particularly collection against Ukraine and its international support base. The focus on government entities, think tanks, NGOs, and financial institutions involved in Ukraine policy or assistance suggests tasking consistent with foreign intelligence objectives. The actor's continuous operational tempo since 2017 and investment in tooling development indicate sustained state resourcing. While specific attribution to Russian intelligence services (SVR, FSB, or GRU) is not provided in available reporting, the targeting pattern and persistence are consistent with state-directed espionage operations rather than financially motivated cybercrime.

Business Impacty pro region

The campaign's geographic and sectoral targeting carries significant implications for transatlantic security cooperation. With primary impact in the United States and United Kingdom—two leading supporters of Ukraine—the operations appear designed to compromise policy deliberations, financial assistance mechanisms, and coordination between Western governments and civil society actors. Ukrainian targets face direct intelligence collection risks that may inform Russian military or diplomatic strategy. European NATO members and EU institutions supporting Ukraine likely face similar exposure, given the targeting of "governments" supporting Ukraine politically or financially. The compromise of think tanks and NGOs threatens the integrity of policy research and advocacy networks that shape Western response to Russian aggression. Financial institutions involved in sanctions implementation, humanitarian assistance, or Ukrainian economic support represent high-value intelligence targets for Russian efforts to circumvent or understand sanctions architecture.

Forecast

If Star Blizzard continues refining automation techniques like RedFlick, the volume and velocity of phishing campaigns targeting Ukraine-related entities are likely to increase, potentially overwhelming organizational defenses that rely on user awareness alone. Should the group successfully compromise key policy institutions or financial networks, Russia may gain advance insight into sanctions decisions, military assistance packages, or diplomatic initiatives, enabling preemptive countermeasures. If Western governments and targeted sectors implement phishing-resistant authentication and EDR solutions in block mode as recommended, the effectiveness of RedFlick campaigns may diminish, likely prompting Star Blizzard to explore alternative initial access vectors or exploit chains. Continued targeting of Ukrainian institutions suggests persistent Russian intelligence requirements that are unlikely to abate absent significant geopolitical shifts in the conflict. Organizations in the identified sectors should anticipate sustained phishing activity employing evolving social engineering and technical delivery mechanisms throughout 2026 and beyond.