Star Blizzard / SEABORGIUM

Overview

Star Blizzard is an operational unit within FSB Centre 18 — Russia's domestic intelligence service — conducting targeted credential theft and influence operations against individuals and organizations of interest to Russian state intelligence. Unlike conventional APT groups that pursue network penetration and data exfiltration from organizational systems, Star Blizzard focuses almost exclusively on compromising the personal email accounts of high-value individuals: government officials, policy advisors, defense researchers, journalists, NGO workers, and academics whose private communications are intelligence targets.

The group's defining operational characteristic is patience. Where many credential phishing actors send unsolicited malicious links to high volumes of targets, Star Blizzard invests significant time in reconnaissance and social engineering before any phishing attempt is made. Operators create convincing false identities — including fabricated social media profiles and fake email accounts impersonating known contacts and domain experts — and establish benign contact with targets on topics of genuine professional interest. After building trust over extended correspondence, sometimes lasting weeks or months, the operator deploys a phishing link framed as a document or resource of interest. The CISA December 2023 advisory explicitly noted this pattern: "There is often some correspondence between attacker and target, sometimes over an extended period, as the attacker builds rapport."

Star Blizzard predominantly sends phishing emails to targets' personal email addresses rather than corporate accounts — a deliberate choice that circumvents corporate email security controls, endpoint monitoring, and security awareness training that organizations apply to business email. The stolen credentials are then used to access and exfiltrate the victim's email account content: private communications, contacts, and documents that often contain sensitive information not present in organizational systems.

The group uses EvilGinx — an open-source adversary-in-the-middle framework — to bypass multi-factor authentication by intercepting both credentials and session cookies simultaneously, rather than just stealing passwords. This MFA bypass means that enabling MFA on personal email accounts does not fully protect against Star Blizzard's credential theft methodology.

From 2024 onward, the group has expanded beyond credential phishing to deploy custom malware against select high-value targets. SPICA (documented in 2024) provided document access on target systems — going beyond email to access files stored locally. LostKeys (documented by Google GTIG in January–April 2025) extends this further: a multi-stage malware delivered via ClickFix social engineering that steals files with specific extensions, harvests system information, and enumerates running processes. Both SPICA and LostKeys are deployed selectively, reserved for targets where email account access alone is insufficient for the intelligence requirement. The group was also documented targeting WhatsApp accounts in January 2025, extending the social engineering model beyond email to messaging platforms.

Two Star Blizzard operators — Ruslan Aleksandrovich Peretyatko and Andrey Stanislavovich Korinets (alias Alexey Doguzhiev) — were indicted by US federal prosecutors in December 2023. UK and US sanctions were applied against both individuals, and the US offered a $10 million reward for information on their location. In October 2024, Microsoft's Digital Crimes Unit and the US Department of Justice coordinated the seizure of 107 domains used by the group for credential phishing infrastructure — 66 seized via Microsoft civil litigation with NGO-ISAC, 41 simultaneously seized by DOJ. The group adapted and continued operations after the seizure.

Target Profile

Star Blizzard's targeting is laser-focused on individuals rather than organizations. The goal is access to private communications, not network penetration — and the individuals targeted are selected based on their access to information of intelligence value to the FSB.

• Government Officials — UK, US, NATO: Current and former government officials with access to defense, foreign policy, and security information. The December 2023 indictment documented targeting of current and former Defense and State Department employees. Former US intelligence officials appeared in targets identified in the October 2024 domain seizure affidavit. The UK government characterized the group's activity as designed to undermine UK organizations and the UK government, with unauthorized access and exfiltration of sensitive data.
• Defense Industrial Base and Department of Energy: During 2022, Star Blizzard expanded to include defense-industrial targets and US Department of Energy facilities — individuals with access to defense procurement, technology, research and development, and nuclear energy information. The DOJ affidavit unsealed in October 2024 noted that access was obtained to information related to nuclear energy technology, research, and development.
• Think Tanks and Policy Organizations: Policy researchers, analysts, and fellows at think tanks with expertise in Russia, Ukraine, NATO, defense, and international security — organizations whose research informs government policy. These targets possess detailed private knowledge of policy debates, government positions, and confidential discussions that does not appear in published work.
• Journalists and Media: Journalists covering Russia, Ukraine, and national security topics. The intelligence objective is not only to access sources and unpublished reporting but also to identify journalists' networks of contacts and confidential sources. Exfiltrated journalist communications have been used in Russian-linked hack-and-leak influence operations.
• NGOs and Civil Society: Organizations supporting democratic institutions, press freedom, human rights in Russia and neighboring states, and organizations providing support to Ukraine. The US Treasury designated the FSB's hack-and-leak operations against NGOs as part of a broader effort to shape narratives and advance Russian strategic interests.
• Academia: Researchers studying Russia, post-Soviet states, Eastern European security, and adjacent fields. Academic researchers' private communications often contain frank assessments, unpublished findings, and contact networks of significant intelligence value.
• Ukraine-Linked Individuals (expanded 2024–2025): Individuals connected to Ukraine — advisors, defense officials, NGO workers — appear specifically in the LostKeys malware campaign targeting from January 2025, reflecting the group's expanded focus on the Ukraine conflict intelligence dimension.

Tactics, Techniques & Procedures

Star Blizzard's TTP set is built around social engineering sophistication rather than technical exploit complexity. The group's operational model prioritizes human manipulation over vulnerability exploitation.

mitre id	technique	description
T1591 / T1593	Reconnaissance — Target Research Phase	Extensive pre-attack reconnaissance is conducted before any contact is initiated. Operators research targets' professional interests, publication history, conference attendance, institutional affiliations, and known contacts. This research informs the creation of convincing false identities and establishes the topic basis for initial benign contact. Fabricated social media profiles are created to support the false identity and provide apparent legitimacy. The group may create fake expert profiles on LinkedIn and other platforms that appear to be active researchers in the target's field, building apparent credibility before outreach.
T1534	Internal Spearphishing — Impersonating Known Contacts	Star Blizzard impersonates known contacts of the target — colleagues, co-authors, conference organizers, or experts in the target's network — rather than approaching as an unknown party. This impersonation uses fabricated email accounts that closely resemble the contact's actual address, or in some cases uses compromised email accounts of actual known contacts to send phishing from an address the target genuinely recognizes. The Five Eyes advisory specifically highlighted the group's "pattern of impersonating known contacts' email accounts to appear trustworthy."
T1566.002	Spearphishing — Rapport-Building + Link Delivery	Initial contact is established on a topic of genuine professional interest to the target — a research paper, policy event, conference, or shared subject area — with benign communication that establishes a correspondence relationship. After rapport is built over days, weeks, or months, the operator sends what appears to be a link to a document or resource of genuine interest. The link leads to a phishing page that captures the target's email credentials and session cookies. The attacker may send subsequent follow-up messages if the initial link is not clicked, expressing concern about whether the document was received.
T1539	Credential Theft + MFA Bypass — EvilGinx	EvilGinx is deployed as an adversary-in-the-middle proxy that intercepts both email credentials and authenticated session cookies simultaneously when the target authenticates to what they believe is a legitimate login page. This approach bypasses multi-factor authentication because the attacker captures the post-MFA session cookie — which authenticates the session without requiring the MFA factor again — rather than just the password. The attacker can replay the session cookie to access the target's email account even if MFA is enabled on the account.
T1114.002	Email Collection — Remote Email Access	After obtaining credentials and session cookies, operators access the target's email account remotely — typically Gmail or Microsoft personal accounts — and systematically exfiltrate the inbox, sent items, and contacts. Private communications, documents shared via email, contact lists, and calendar data are extracted. The exfiltrated content may subsequently be used in FSB intelligence reporting or, in some cases, selectively published as part of hack-and-leak influence operations designed to shape narratives in targeted countries.
T1566 / T1059	ClickFix — LostKeys Malware Delivery (2025)	The LostKeys delivery chain begins with a lure website presenting a fake CAPTCHA. When the victim completes the fake CAPTCHA verification, JavaScript on the page automatically copies a malicious PowerShell command to the clipboard. The page instructs the victim to verify they are human by opening the Windows Run prompt and pasting the command — a social engineering technique called ClickFix that requires user action to execute the payload, bypassing automated browser and email sandbox defenses. The first-stage PowerShell fetches a second stage from C2 (165.227.148[.]68 in documented cases). The second stage performs anti-VM checks (display resolution hash) before fetching the final LostKeys VBScript payload, which exfiltrates files with specific extensions, captures system information, and enumerates running processes.
T1041	SPICA and LostKeys — Selective Document Theft	SPICA (documented 2024) and LostKeys (2025) are deployed only against select high-value targets for whom email account access alone does not satisfy the intelligence requirement. LostKeys steals files from a hard-coded list of extensions and directories, sends system information and a running process list to the attacker, and operates through a per-victim unique identifier-keyed C2 communication chain. LostKeys samples use per-infection unique identifiers and encryption keys, meaning each deployment is individually customized — further confirming the selective, high-value targeting model.

Known Campaigns

Star Blizzard has operated continuously since at least 2017, with major public disclosures and law enforcement actions concentrated from 2022 onward.

Tools & Malware

Star Blizzard operates a focused toolkit centered on credential harvesting infrastructure and, increasingly, selective endpoint malware for highest-value targets.

• EvilGinx (Adversary-in-the-Middle Credential Theft): An open-source framework used as the core credential phishing tool. EvilGinx acts as a transparent proxy between the victim and the legitimate email service, intercepting both the entered credentials and the authenticated session cookie that follows successful MFA completion. This simultaneous credential and session cookie theft bypasses time-based OTP and SMS MFA. The stolen session cookie is replayed to access the account as an authenticated user without requiring the MFA factor.
• Lookalike Credential Harvesting Domains: Star Blizzard registers domains that resemble legitimate organizations, email services, file sharing platforms, or research institutions — creating convincing-looking login pages that redirect harvested credentials to attacker infrastructure. Recorded Future identified 94 new domains in August 2023; the October 2024 seizure covered 107. Domain registration patterns often feature IT and cryptocurrency-related keywords alongside institutional name mimicry.
• Fabricated Social Media and Email Profiles: False identities constructed to support the rapport-building phase — LinkedIn profiles, X/Twitter accounts, and email accounts presenting the operator as a credible researcher, journalist, policy expert, or conference organizer in the target's field. The fabricated identities are used to initiate and sustain benign correspondence before any phishing attempt is made.
• SPICA Backdoor (2024): A custom malware deployed selectively against high-value targets where email account access alone is insufficient. SPICA provides access to documents stored on the target's device, extending collection beyond the email inbox. Delivered via spearphishing as part of the group's expanded malware deployment capability, documented by Google TAG in January 2024.
• LostKeys (2025): A Visual Basic Script-based malware delivered via a ClickFix fake CAPTCHA social engineering chain. Capabilities include stealing files from a hard-coded extension and directory list, collecting system information (systeminfo, ipconfig, net view), and enumerating running processes (tasklist). Each infection uses unique per-victim identifiers and encryption keys. The second-stage payload performs anti-VM display resolution hashing checks before delivering LostKeys. C2 communication sends encoded data including computer name, username, and drive serial number as a session identifier.

Indicators of Compromise

Star Blizzard's phishing infrastructure rotates continuously — the October 2024 seizure covered 107 domains and the group immediately began rebuilding. Behavioral indicators are more durable than static domain or IP lists.

Mitigation & Defense

Star Blizzard's social engineering model requires defenses that operate at the individual level — organizational email security controls are partially bypassed by design when the attack targets personal email accounts.

• Replace TOTP and SMS MFA with FIDO2 hardware security keys on personal email accounts: EvilGinx bypasses time-based one-time passwords and SMS codes by intercepting session cookies after MFA completion. FIDO2 hardware keys (such as YubiKey) perform cryptographic authentication bound to the originating domain — they cannot authenticate to a phishing proxy because the domain does not match. Individuals in Star Blizzard's target categories — government officials, defense researchers, journalists, NGO workers, think tank analysts — should configure FIDO2 hardware keys as their MFA factor on personal Gmail and Microsoft accounts specifically.
• Apply advanced account protection programs: Google's Advanced Protection Program and Microsoft's equivalent apply the highest security settings to an account — requiring hardware key authentication, restricting third-party application access, and adding enhanced phishing detection. These programs are specifically designed for high-risk individuals and are free to enroll in. They are the appropriate baseline security posture for anyone in Star Blizzard's documented target categories.
• Treat unsolicited benign contact from unknown experts with deliberate skepticism: Star Blizzard's operational model requires the target to engage in correspondence before any phishing link is sent. Individuals in target categories who receive unsolicited contact from unknown researchers, journalists, or experts — particularly those expressing interest in the recipient's specific work — should verify the sender's identity through a separate channel before engaging. A social media profile appearing to be a credible expert does not verify identity; a phone call or video call with a known institutional contact who can confirm the person exists does.
• Verify any link to documents or resources before clicking: When a correspondent — even a trusted-appearing one — sends a link to a document, verify the destination domain before authenticating. Star Blizzard's phishing pages are designed to appear as legitimate login portals for Google, Microsoft, or other services. Any login prompt reached by following a link from email or messaging should be treated with suspicion; navigate directly to the service's official domain rather than authenticating through a link.
• Do not execute commands pasted from websites: The LostKeys ClickFix delivery chain requires the victim to manually open Windows Run (Win+R) and paste a clipboard command. No legitimate website or CAPTCHA service ever requires this action. Any webpage instructing a user to paste clipboard content into the Windows Run dialog or a command prompt should be immediately closed and reported. This is an unconditional indicator of a malicious delivery attempt.
• Monitor PowerShell execution from unusual contexts: The LostKeys infection chain executes PowerShell via the Windows Run dialog rather than a command-line context. Endpoint detection rules alerting on PowerShell spawned by explorer.exe (the Run dialog parent process) rather than standard administrative contexts provide detection of ClickFix-technique malware delivery.
• Enable Google Safe Browsing Enhanced Protection and government-backed alert programs: Google updated Safe Browsing to block LostKeys-associated domains following the May 2025 GTIG disclosure. Google also provides government-backed threat alerts to Gmail and Workspace users targeted by state-sponsored actors. Ensuring Enhanced Protection is enabled in Chrome and that Google Workspace alerts are appropriately configured provides automated notification of known Star Blizzard infrastructure.

Sources & Further Reading

Attribution and references used to build this profile.

• MITRE ATT&CK — Star Blizzard (G1033)
• CISA — Russian FSB Cyber Actor Star Blizzard Continues Worldwide Spearphishing Campaigns (December 2023)
• NCSC — Russian FSB cyber actor Star Blizzard continues worldwide spear-phishing campaigns (2023)
• Google GTIG — COLDRIVER Using New Malware To Steal Documents From Western Targets and NGOs (2025)
• CyberScoop — DOJ, Microsoft seize more than 100 domains used by the FSB (October 2024)
• The Hacker News — Microsoft Warns of COLDRIVER's Evolving Evasion and Credential-Stealing Tactics (2023)
• SecurityWeek — Russia-Linked APT Star Blizzard Uses ClickFix to Deploy New LostKeys Malware (2025)