THREATOPS Actor Dossier
LIVE ← Dashboard

Star Blizzard

G10331 reports
aliases · Star Blizzard · SEABORGIUM · Callisto Group · TA446 · COLDRIVER
Export dossier:
1
Reports
2
Techniques
2
Tactics
5
Countries
50%
Hunt coverage
5
Aliases

Analyst assessment — key judgments

  • Signature techniques: T1593.001 (Social Media), AML.T0016.002 (Generative AI).
  • Primary targeting: RU, UA, US, IR.
  • Newly emerged: 1 report(s) in last 30d vs 0 prior (+100%).
  • Recent movement: 2 new technique(s), 12 new infrastructure indicator(s) in the last 30 days.
  • Hunt coverage 50% of 2 observed techniques (1 gap(s)).
  • Assessment confidence: medium (60).

Activity & trend

Newly emergedLast 30d: 1 vs 0 prior (+100%)· first reported 2026-06-29 · last 2026-06-29
0
7d
1
30d
1
90d
1
All
0.1
Rpts/wk
Reporting timeline · 12 months

Movement — last 30 days

New techniques
T1593.001AML.T0016.002
Targeting gained
ILIRRUUAUS
New infrastructure
9e495017dc5c4bf24a0b6152863dbfb1https://www.marshallcenter.org/en/publichttps://apnews.com/article/iran-war-imaghttps://www.rusi.org/explore-our-researchttps://www.bbc.com/news/articles/cz91dkhttps://home.treasury.gov/news/press-relhttps://cert.gov.ua/article/6287707https://caspianpost.com/regions/russian-https://www.justice.gov/opa/pr/justice-dhttps://home.treasury.gov/news/press-relhttps://home.treasury.gov/news/press-relhttps://projectshield.withgoogle.com/lan

Overview

Analyst triage
Intelligence summary

Star Blizzard is a cyber espionage and influence group originating in Russia that has been active since at least 2019. Star Blizzard campaigns align closely with Russian state interests and have included persistent phishing and credential theft against academic, defense, government, NGO, and think tank organizations in NATO countries, particularly the US and the UK.(Citation: Microsoft Star Blizzard August 2022)(Citation: CISA Star Blizzard Advisory December 2023)(Citation: StarBlizzard)(Citation: Google TAG COLDRIVER January 2024)

Top co-occurring indicators
    Aliases & naming
      Targeting · countries
        Targeting · named victims

          ATT&CK technique matrix

          Coverage vs hunt library:
          —
          Hunt-coverage gaps — prioritized

            Top techniques by observation

            Threat catalogue · engineering roadmap0

            Flagged detection-engineering queue

            Uncovered techniques you flagged for hunt / detection build-out, aggregated across every actor you visit. Stored locally in your browser.

              No techniques queued yet — flag a gap above to add it here.

              Infrastructure

              IOC type mix
              Tooling / malware families
                Tracked infrastructure

                Relationships

                Related actors (behavioral cluster)
                  Attributed malware
                  Campaigns
                  No behavioral cluster, attributed malware, or campaigns recorded for this actor yet.

                  Activity

                  30-day mention timeline
                  Recent reporting
                  TitleSourceSeverityCollected