Star Blizzard does not break in with exploits; it earns trust over weeks of polite email, then sends a link to a sign-in page that captures both the password and the session cookie. This profile draws on the joint advisory published by the UK NCSC and Five Eyes partners on 7 December 2023, the UK government attribution statement of the same day, Microsoft Threat Intelligence, Google's Threat Analysis Group and Threat Intelligence Group, and MITRE ATT&CK v20. It covers names and aliases, who the group targets and why, techniques mapped to ATT&CK, how it abuses mailboxes and sessions, the main public campaigns, and the controls that break the chain. It is written for security teams protecting government, defence, research, think tank and NGO staff, and for anyone responsible for the personal accounts of high-profile people, which the group targets as often as corporate ones.
Key takeaways
- A state espionage unit with a phishing specialism. The UK assesses Star Blizzard as almost certainly subordinate to Centre 18 of Russia's Federal Security Service (FSB), and the seven-agency advisory describes spear-phishing for information gathering as its core activity.
- Rapport comes before the payload. Operators research targets on social media, impersonate known contacts from webmail accounts and lookalike domains, and only send the malicious link once a conversation is under way.
- Password-plus-OTP MFA is not enough. The group uses the Evilginx adversary-in-the-middle framework to capture session cookies, so code-based MFA is relayed; phishing-resistant authentication (FIDO2 or passkeys) is the control that holds.
- Personal accounts are a primary target. NCSC notes links are often sent to personal rather than corporate email, and Microsoft found about 30 per cent of its nation-state notifications for this actor went to consumer accounts.
- Forwarding rules are the persistence. After access the group reads mail, sets forwarding rules to attacker accounts and phishes onward from the victim; disabling external auto-forwarding and auditing rules removes its quiet collection channel.
Who they are (names and aliases)
MITRE ATT&CK tracks the group as G1033 Star Blizzard and describes it as a Russia-origin cyber espionage and influence group active since at least 2019, with campaigns aligned to Russian state interests. Microsoft named it SEABORGIUM until April 2023, when it moved to the weather-themed naming scheme. Microsoft's October 2024 statement says the group has been active since at least 2017, and the UK government links it to spear-phishing of parliamentarians from at least 2015, so start dates vary by source.
| Name | Used by | Notes |
|---|---|---|
| Star Blizzard | Microsoft (current), NCSC, MITRE ATT&CK G1033 | Primary name in the December 2023 advisory |
| SEABORGIUM | Microsoft (until April 2023) | Name used in Microsoft's August 2022 disruption report |
| COLDRIVER, UNC4057 | Google TAG and GTIG | Google's reporting on SPICA and LOSTKEYS malware |
| Callisto Group | NCSC, Google, MITRE | Older industry name |
| TA446 | NCSC advisory, MITRE | Proofpoint naming |
| TAG-53, BlueCharlie | NCSC advisory | Recorded Future naming |
On 7 December 2023 the UK sanctioned two people it described as Star Blizzard members, one an FSB intelligence officer, in coordination with the United States, and the US Department of Justice unsealed indictments against the same two. See the Threat Actor Groups Guide for how vendor naming schemes map to each other, and the APT29 (Midnight Blizzard) Threat Actor Profile for a different Russian service's tradecraft.
Targeting and motivation
- Motivation: intelligence collection in support of Russian strategic interests (Google GTIG), with hack-and-leak operations as a secondary effect. The UK says some attacks led to leaked documents but that attempts to interfere with UK politics were not successful.
- Sectors: the advisory lists academia, defence, government, NGOs, think tanks and politicians since 2019, expanding in 2022 to defence-industrial companies and US Department of Energy facilities. Microsoft adds defence and intelligence consulting, international relations researchers, organisations assisting Ukraine, logistics support and information security firms.
- Individuals: former intelligence and military officials, Russia experts, journalists, advisers to Western governments, and Russian citizens abroad. Microsoft's October 2024 statement counts 82 targeted Microsoft customers between January 2023 and August 2024, roughly one attack a week, and more than 30 civil society organisations.
- Geography: mainly the UK and US, then other NATO members, the Baltics, Nordics, Eastern Europe and Russia's neighbours.
- Selection logic: people rather than networks. A think tank fellow's personal mailbox can be worth more than the organisation's domain, which is why the group does not need to touch corporate infrastructure at all.
Tactics and techniques (MITRE ATT&CK)
The NCSC advisory lists thirteen ATT&CK techniques; the table maps them, plus later techniques recorded by Google and ATT&CK v20, to the defence that interrupts each step. All IDs were checked against ATT&CK v20.
| Stage | Technique | What sources describe | Primary defence |
|---|---|---|---|
| Reconnaissance | T1593 Search Open Websites/Domains; T1589 Gather Victim Identity Information | Open-source and social media research on targets and their contacts | Digital footprint reduction for high-risk staff |
| Resource development | T1585.001 Social Media Accounts; T1585.002 Email Accounts; T1586.002 Email Accounts (compromised) | Fake LinkedIn personas; webmail accounts in the names of real contacts; reuse of accounts already taken from earlier victims | Out-of-band verification of new addresses for known contacts |
| Resource development | T1583.001 Domains | Lookalike domains in batches, moving between registrars (Microsoft lists Hostinger, RealTime Register and GMO Internet in 2024) with Let's Encrypt certificates | Newly registered domain blocking; lookalike monitoring |
| Initial access | T1566.001 Spearphishing Attachment; T1566.002 Spearphishing Link | PDF lures, fake OneDrive and Proton Drive shares, links wrapped in shorteners, open redirects and marketing platforms (HubSpot, MailerLite) | Click-time URL rewriting and detonation; sender verification |
| Credential access | T1539 Steal Web Session Cookie | Evilginx reverse proxy captures credentials and session cookies, bypassing code-based MFA | Phishing-resistant MFA; token binding; continuous access evaluation |
| Defence evasion and access | T1550.004 Web Session Cookie; T1078 Valid Accounts | Replay of stolen cookies and passwords to sign in as the victim | Conditional access on device compliance; anomalous sign-in alerts |
| Collection | T1114.002 Remote Email Collection; T1114.003 Email Forwarding Rule | Reading mail and attachments; forwarding to attacker "dead drop" accounts; harvesting contact lists | Block external auto-forwarding; alert on new inbox rules |
| Execution (selective) | T1204.002 Malicious File; T1053.005 Scheduled Task | SPICA backdoor posing as a PDF "decryption" tool, persisting through a scheduled task named CalendarChecker (Google TAG, 2024) | Application control; block unsigned executables from cloud links |
| Execution (selective) | T1204.004 Malicious Copy and Paste; T1059.001 PowerShell | Fake CAPTCHA pages copy PowerShell to the clipboard and ask the user to run it, leading to LOSTKEYS (Google GTIG, 2025) | Restrict script execution for standard users; block Run dialog abuse |
The evasion layer is what changes most. Microsoft's December 2023 report records browser fingerprinting that checks for automation tools such as Selenium and PhantomJS, hCaptcha gating, password-protected PDFs and cloud links that email scanners cannot open, and a separate redirector server in front of each Evilginx server. See the AiTM Phishing Guide for the general mechanics.
How they abuse identities and credentials
Human accounts
- Session theft over password theft: because Evilginx proxies the real sign-in page, the victim completes MFA and the attacker keeps the resulting cookie. Microsoft's guidance calls out the "Stolen session cookie was used" alert as the AiTM signal to watch. See the Session Hijacking and Cookie Theft Guide.
- Personal webmail as the soft target: the advisory notes links are often sent to personal addresses, where corporate filtering, conditional access and logging do not reach. A senior official's work account can be well defended while the same person's personal mailbox holds the same conversations.
- Compromised accounts as trusted senders: once inside, the group uses the victim's account to phish the victim's contacts (T1586.002), so the next lure arrives from a genuine address with real history. Sender reputation checks pass.
- Messaging accounts: in November 2024 Microsoft observed a campaign impersonating a US government official that tricked targets into scanning a QR code which linked their WhatsApp account to an attacker-controlled device, giving access to messages. See the QR Code Phishing (Quishing) Guide.
Non-human identities and mailbox automation
- Inbox and forwarding rules: a forwarding rule is a standing, unattended data flow that outlives a password reset unless someone removes it. NCSC advises disabling forwarding or checking forwarding settings regularly. See the Email Security Guide.
- Session tokens as bearer credentials: a stolen cookie is a credential with no user present. Shorter session lifetimes, continuous access evaluation and revocation on password reset limit how long it works. See the Token and Session Security Guide.
- Linked devices: WhatsApp linked devices and similar companion sessions are long-lived authorisations that users rarely review; treat them like OAuth grants and check them during incident response.
Notable incidents
| When | Campaign or event | What sources describe |
|---|---|---|
| 2015 to 2023 | UK parliamentarians | UK government attributes spear-phishing of MPs from multiple parties to Star Blizzard |
| 2018 and from December 2021 | Institute for Statecraft | Hack of the UK think tank and later compromise of its founder's account, with documents leaked in both cases (UK government) |
| 2019 | UK-US trade documents | Documents leaked before the 2019 General Election; the UK attributes the operation to Star Blizzard |
| August 2022 | Microsoft disruption | Microsoft disables SEABORGIUM accounts and publishes domains; notes a 2022 Brexit-related hack-and-leak linked with Google TAG |
| Late 2022 to 2023 | SPICA malware | Google TAG reports encrypted-PDF lures followed by a fake decryption tool delivering the Rust SPICA backdoor, observed from September 2023 |
| 7 December 2023 | Five Eyes advisory and sanctions | NCSC, CISA, FBI, NSA, US Cyber National Mission Force, ASD's ACSC, CCCS and NCSC-NZ publish the advisory; UK and US sanction two members |
| 3 October 2024 | Domain seizures | Microsoft seizes 66 domains under a civil action with NGO-ISAC; the US Department of Justice seizes 41 more |
| November 2024 | WhatsApp QR campaign | Microsoft reports the first shift to WhatsApp account takeover via linked devices |
| January to April 2025 | LOSTKEYS | Google GTIG reports ClickFix-style fake CAPTCHA lures delivering the VBS-based LOSTKEYS file stealer in highly selective cases |
Detection and defence
Phased response for a defender
- Identify the people, not the systems: list staff and associates who match the targeting profile (policy, defence, Russia and Ukraine work, former officials, executives with public profiles) and include their personal accounts in scope by agreement.
- Move them to phishing-resistant authentication: FIDO2 security keys or passkeys on corporate accounts, and enrolment in consumer high-risk programmes such as Google's Advanced Protection Program for personal Gmail. Pilot with a small group, keep a break-glass recovery path, and only then remove SMS and OTP fallbacks.
- Close the collection channel: block external auto-forwarding at the tenant level, audit existing forwarding and inbox rules, and alert on new ones. Test in report-only mode for a week to find legitimate business forwarding before enforcing.
- Harden sessions: conditional access requiring compliant or managed devices for sensitive users, continuous access evaluation, and revocation of all sessions plus rule review on any suspected compromise.
- Harden email and endpoints: click-time link checks, treatment of password-protected attachments and newly registered domains as high risk, application control or script restrictions so standard users cannot run PowerShell from the Run dialog or unsigned tools from downloads.
- Train for the pattern: brief high-risk staff on rapport-then-link approaches, unreadable "encrypted" documents, QR codes to join groups and CAPTCHA pages that ask for commands; give them a quick route to verify a contact through a known channel and to report.
What to log and alert on
| Signal | Source | Why it matters |
|---|---|---|
| New-InboxRule, Set-InboxRule, Set-Mailbox forwarding | Microsoft 365 unified audit log (or Google Workspace admin and Gmail logs) | The group's persistence and collection mechanism |
| Sign-in with a token from a new ASN, country or user agent shortly after a successful interactive sign-in | Entra ID sign-in logs, identity protection risk detections | Typical shape of cookie replay after AiTM |
| Clicks to newly registered domains, link shorteners and marketing redirect chains | Secure email gateway, web proxy | Matches documented delivery infrastructure |
| Inbound mail from webmail or Proton accounts using the display name of a known contact | Email gateway rules | Core impersonation technique |
| powershell.exe spawned by explorer.exe from the Run dialog; scheduled task CalendarChecker | EDR, Sysmon | LOSTKEYS and SPICA execution paths |
Metrics that show it is working
- Phishing-resistant coverage: percentage of identified high-risk users whose only sign-in methods are FIDO2 or passkeys.
- External forwarding: count of mailboxes forwarding outside the organisation; target zero without an approved exception.
- Time to revoke: minutes from a reported phish to session revocation and inbox rule review for that user.
- Report rate: share of simulated rapport-style and QR lures reported by high-risk staff.
- Personal account enrolment: number of high-risk people who have enrolled personal mail in a high-risk protection programme.
Decision guidance
Small NGOs and think tanks without a SOC get the largest gain from security keys for a handful of exposed staff, disabled forwarding and a simple "verify by phone" habit; NCSC and Google both offer free guidance and programmes for this audience. Larger organisations should combine phishing-resistant MFA with device-bound conditional access, so that even a captured cookie is rejected from an unmanaged device, and run detection on mailbox rules and token anomalies. Where an organisation cannot control personal accounts, it should at least advise high-risk people and keep sensitive work off personal channels. See the Phishing-Resistant MFA Guide and the Executive Protection and Digital Footprint Guide.
Framework mapping
| Control area | NIST SP 800-53 Rev. 5 | NIST CSF 2.0 |
|---|---|---|
| Phishing-resistant MFA | IA-2, IA-2(1) | PR.AA-03 |
| Email filtering and link protection | SI-8 | DE.CM-01 |
| Awareness and practical exercises | AT-2, AT-2(1) | PR.AT-01 |
| Monitoring of account and mailbox activity | SI-4, AU-6 | DE.CM-03 |
| Restrict script and tool execution | CM-7, CM-7(5) | PR.PS-05 |
Practitioner checklist
- Identify staff and associates who match the targeting profile, including former officials and advisers.
- Issue FIDO2 keys or passkeys to them and remove OTP and SMS fallbacks after a pilot.
- Advise high-risk people to enrol personal email in a high-risk protection programme.
- Block external auto-forwarding and audit all existing forwarding and inbox rules.
- Alert on new inbox rules and on token sign-ins from new ASNs or user agents.
- Require managed or compliant devices for sensitive users through conditional access.
- Treat password-protected attachments and newly registered domains as high risk at the gateway.
- Stop standard users running PowerShell from the Run dialog and unsigned downloaded tools.
- On any suspected compromise: revoke sessions, reset credentials, remove rules and linked devices, warn contacts.
Standards and references
- NCSC and Five Eyes partners: Star Blizzard continues spear-phishing campaigns
- UK Government: UK exposes attempted Russian cyber interference in politics and democratic processes
- MITRE ATT&CK: Star Blizzard (G1033)
- Microsoft: Star Blizzard increases sophistication and evasion in ongoing attacks
- Microsoft: Disrupting SEABORGIUM's ongoing phishing operations
- Microsoft: New Star Blizzard spear-phishing campaign targets WhatsApp accounts
- Google Threat Analysis Group: COLDRIVER expands targeting with SPICA malware
- Google Threat Intelligence Group: COLDRIVER and LOSTKEYS malware
Related NHI Mgmt Group resources: Threat Actor Groups Guide · AiTM Phishing Guide · APT28 (Fancy Bear) Threat Actor Profile · Phishing-Resistant MFA Guide · Session Hijacking and Cookie Theft Guide