MITRE ATT&CKgroup
G1033 Star Blizzard
- Domain
- enterprise, mobile
- Aliases
- SEABORGIUM, Callisto Group, TA446, COLDRIVER
- Version
- 2.0
- Created
- 2024-06-14
Description
Star Blizzard is a cyber espionage and influence group originating in Russia that has been active since at least 2019. Star Blizzard campaigns align closely with Russian state interests and have included persistent phishing and credential theft against academic, defense, government, NGO, and think tank organizations in NATO countries, particularly the US and the UK.
Related
Uses · MITRE ATT&CK (22)
- T1684.001 Impersonation sub-technique
- T1676 Linked Devices technique
- S1140 Spica software (malware)
- T1608.001 Upload Malware sub-technique
- T1589 Gather Victim Identity Information technique
- T1593 Search Open Websites/Domains technique
- T1598.002 Spearphishing Attachment sub-technique
- T1598.003 Spearphishing Link sub-technique
- T1585.001 Social Media Accounts sub-technique
- T1585.002 Email Accounts sub-technique
- T1586.002 Email Accounts sub-technique
- T1588.002 Tool sub-technique
- T1583 Acquire Infrastructure technique
- T1583.001 Domains sub-technique
- T1059.007 JavaScript sub-technique
- T1204.002 Malicious File sub-technique
- T1566.001 Spearphishing Attachment sub-technique
- T1114.002 Remote Email Collection sub-technique
- T1114.003 Email Forwarding Rule sub-technique
- T1550.004 Web Session Cookie sub-technique
- T1539 Steal Web Session Cookie technique
- T1078 Valid Accounts technique
References
- https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-341a CISA Star Blizzard Advisory December 2023
- https://www.microsoft.com/en-us/security/blog/2022/08/15/disrupting-seaborgiums-ongoing-phishing-operations/ Microsoft Star Blizzard August 2022
- https://www.microsoft.com/en-us/security/blog/2023/12/07/star-blizzard-increases-sophistication-and-evasion-in-ongoing-attacks/ StarBlizzard
- https://blog.google/threat-analysis-group/google-tag-coldriver-russian-phishing-malware/ Google TAG COLDRIVER January 2024