STAR BLIZZARD (SEABORGIUM)

Star Blizzard, formerly tracked by Microsoft as Seaborgium and by other researchers as the Callisto Group, is a Russian Federal Security Service (FSB) threat actor attributed to the FSB's Centre 18 unit. The group specialises in credential harvesting and long-term spear-phishing campaigns against Western government officials, defence policy experts, journalists, think tanks, and civil society organisations , particularly those focused on Russia, Ukraine, and NATO affairs.

Star Blizzard's hallmark technique involves creating highly convincing impersonation accounts of trusted individuals , colleagues, conference organisers, or government officials , to trick targets into clicking malicious links that redirect to credential harvesting pages. The group invests significant time in building rapport with targets before delivering the phishing payload, demonstrating sophisticated social engineering capabilities.

The group has been linked to several significant intelligence operations, including the theft of sensitive internal communications from UK political figures and the attempted compromise of US government email accounts. Perhaps most notably, Star Blizzard has been associated with stealing private correspondence from UK-US trade negotiation participants, which was subsequently leaked online to generate political controversy , demonstrating their role in Russian information operations beyond pure intelligence collection.

In October 2024, Microsoft and the US Department of Justice jointly seized over 100 internet domains used by Star Blizzard for spear-phishing infrastructure, significantly disrupting the group's operational capabilities. The FSB's continued use of Star Blizzard to target civil society and democratic institutions underscores Russia's broad approach to using cyber operations as a tool of political warfare against Western democracies.

Cyber Espionage Tactics and Persistence Mechanisms: Operational tracking indicates that Star Blizzard (Seaborgium) executes long-term cyber espionage campaigns aligned with strategic intelligence requirements. The threat group weaponizes spear-phishing lures with malicious Office attachments, exploits unpatched edge appliances and VPN gateways, and establishes covert command-and-control (C2) channels using custom backdoors and legitimate administrative binaries. Defending against these advanced persistent threats requires comprehensive endpoint detection and response (EDR) visibility, continuous credential auditing, and proactive threat hunting across sensitive network enclaves.