Quick links
Press Enter to search, Esc to close
Threat group profile
Attributed by the UK, US, Australian, Canadian and New Zealand governments to Russia's Federal Security Service (FSB) Center 18, this group is linked to long phishing campaigns against politicians, researchers, journalists and government staff in the UK, US and other NATO countries.
In short
Attributed by the UK, US, Australian, Canadian and New Zealand governments to Russia's Federal Security Service (FSB) Center 18, this group is linked to long phishing campaigns against politicians, researchers, journalists and government staff in the UK, US and other NATO countries. It steals email logins and reads the victims' mail.
Public reports use several names for this activity.
| Name | Where it appears |
|---|---|
| Star Blizzard | MITRE ATT&CK G1033 (group name); CISA and partner advisory AA23-341A; UK Foreign Office; US Treasury; US Department of Justice[1, 2, 4, 7, 8] |
| SEABORGIUM | MITRE Associated Groups; the advisory says Star Blizzard was "formerly known as" this name[1, 2] |
| Callisto Group | MITRE Associated Groups; the advisory; UK sanctions notice; US Treasury; US Department of Justice; Rewards for Justice[1, 2, 6, 7, 8, 9] |
| TA446 | MITRE Associated Groups; the advisory[1, 2] |
| COLDRIVER | MITRE Associated Groups; the advisory; UK Foreign Office; US Treasury[1, 2, 4, 7] |
| TAG-53 | The advisory and the UK Foreign Office press release (not in MITRE's list)[2, 4] |
| BlueCharlie | The advisory and the UK Foreign Office press release (not in MITRE's list)[2, 4] |
| Cold River | Spelling used in the UK sanctions notice[6] |
| Gossamer Bear | US Treasury press release only[7] |
| ReUse Team | US Treasury press release only[7] |
| Dancing Salome | US Treasury press release and US Department of Justice[7, 8] |
Attribution is a judgment by the body named. It is shown here as attributed, not as proven fact.
MITRE ATT&CK Entry last modified 31 July 2026
Describes Star Blizzard as a cyber espionage and influence group originating in Russia whose campaigns align closely with Russian state interests. It names no agency.[1]
UK NCSC, US CISA, FBI, NSA and Cyber National Mission Force, Australia ACSC, Canada Cyber Centre, New Zealand NCSC 7 December 2023
Assess that Star Blizzard is almost certainly subordinate to the Russian FSB Center 18.[2, 3]
UK Foreign Office 7 December 2023
Said the FSB is behind sustained attempts to interfere in UK political processes. Said FSB Center 18 was identified as accountable for cyber espionage against the UK and that Star Blizzard is operated by FSB officers.[4]
UK National Crime Agency 7 December 2023
Said its investigation led to sanctions on two members of the Callisto Group, which the NCSC assesses is almost certainly subordinate to FSB Center 18.[5]
UK sanctions notice (OFSI) 7 December 2023
Listed Korinets and Peretyatko. The statement of reasons calls the Callisto Group a cyber program operated by officers of the Russian FSB.[6]
US Department of the Treasury 7 December 2023
Designated two individuals tied to an APT group it says is sponsored by the FSB, and described Peretyatko as an FSB officer.[7]
US Department of Justice 7 December 2023
Unsealed an indictment of Peretyatko, an officer in FSB Center 18, and Korinets, charging a hacking campaign carried out on behalf of the Russian government.[8]
US Department of State (Rewards for Justice) Announced 7 December 2023
Describes the Callisto Group as an entity managed by the FSB and offers up to $10 million for information on Korinets and Peretyatko.[7, 9, 10]
US Department of Justice 3 October 2024
Affidavit says the seized domains were used by hackers belonging to, or criminal proxies working for, the Callisto Group, an operational unit within FSB Center 18.[11]
Sources differ on confidence. The advisory of 7 December 2023 and the UK Foreign Office press release say "almost certainly subordinate" to FSB Center 18, but the Background note on the same UK press release says "highly likely subordinate". Sources also differ on when the activity began. MITRE and the advisory give 2019, the UK says spearphishing of parliamentarians from at least 2015, the US Treasury says as early as 2016, and the US indictment covers at least October 2016 to October 2022. Sources also describe the group differently: the US Department of Justice in October 2024 calls the Callisto Group an operational unit within Center 18 and also refers to criminal proxies, while the UK describes a group operated by FSB officers. MITRE does not name the agency.
Each entry is attributed to the group by the sources cited.
The UK says spearphishing of parliamentarians from multiple parties ran from at least 2015.[4]
The US indictment says the hacking conspiracy ran from at least October 2016 to October 2022.[8]
Treasury says Peretyatko used a fraudulent email account to send emails purporting to be from a major software company, asking victims to change their password.[7]
The UK says the account of the Institute for Statecraft founder was compromised from December 2021 and documents were leaked.[4]
MITRE says the custom backdoor Spica has been used by Star Blizzard since at least 2023.[12]
The US Department of Justice announced a warrant to seize 41 internet domains used by the Callisto Group.[11]
Indictments, sanctions and advisories that name the group or its alleged members.
| Date | Who | What |
|---|---|---|
| 7 December 2023 | UK NCSC with CISA, FBI, NSA, CNMF, ACSC, Canadian Cyber Centre, NCSC-NZ | Joint advisoryPublished AA23-341A on Star Blizzard spearphishing, with techniques and mitigations.[2, 3] |
| 7 December 2023 | UK Foreign Office | Sanctions and summonsSanctioned Peretyatko and Korinets with the US, and summoned the Russian Ambassador.[4, 6] |
| 7 December 2023 | UK National Crime Agency | InvestigationSaid its investigation led to the sanctions on two Callisto Group members.[5] |
| 7 December 2023 | US Department of the Treasury (OFAC) | SanctionsDesignated Peretyatko and Korinets under E.O. 13694, as amended by E.O. 13757.[7] |
| 7 December 2023 | US Department of Justice | Indictment unsealedCharged both men with one count of conspiracy to commit computer fraud. The release says the grand jury returned the indictment on the Tuesday before.[8] |
| 7 December 2023 | US Department of State (Rewards for Justice) | Reward offerOffered up to $10 million for information on the two men.[7, 9, 10] |
| 3 October 2024 | US Department of Justice | Domain seizureUnsealed a warrant to seize 41 internet domains, in step with a separate civil action by a private company on 66 more domains.[11] |
Techniques reported for this group, by MITRE ATT&CK tactic.
Establish Accounts: Social Media Accounts T1585.001
Creates fake profiles on professional networking sites and impersonates respected experts.[1, 2]
Establish Accounts: Email Accounts T1585.002
Registers consumer webmail accounts that match the names of people it impersonates.[1, 2]
Acquire Infrastructure: Domains T1583.001
Registers domains that resemble legitimate organizations to host its phishing framework.[1, 2]
Compromise Accounts: Email Accounts T1586.002
Uses compromised email accounts to phish contacts of the original victim.[1, 2]
Phishing: Spearphishing Link T1566.002
Sends links to credential-stealing sites, directly or through documents on file-sharing sites.[2, 13]
Phishing: Spearphishing Attachment T1566.001
The advisory says malicious links are embedded in attachments. MITRE also lists emails with malicious .pdf files.[1, 2]
Valid Accounts T1078
Signs in to victim email accounts with stolen credentials.[1, 2, 15]
Email Collection: Remote Email Collection T1114.002
Accesses email through externally facing mail services using stolen credentials or access tokens.[1, 2]
Email Collection: Email Forwarding Rule T1114.003
Sets mail forwarding rules to watch victims and keep access after passwords are reset.[1, 2]
Linked Devices T1676
MITRE says it has used the linked devices feature to connect WhatsApp accounts to its own infrastructure and steal messages.[1, 16]
EvilGinx Open-source phishing framework
Harvests credentials and session cookies to get around two-factor authentication.[1, 2]
Spica Custom backdoor
MITRE says it is written in Rust, used since at least 2023, and creates a scheduled task named CalendarChecker for persistence.[12]
Malware to evade two-factor authentication (not named) Malware
Treasury says Star Blizzard officers researched malware that allows evasion of two-factor authentication.[7]
Remote-control malware (not named) Malware
Treasury says officers researched malware that allows control of a device with limited risk of detection.[7]
Webmail access tool (not named) Tool
Treasury says officers researched a third tool that allows access to webmail inboxes.[7]
The advisory says to disable mail forwarding, or check regularly that no forwarding rule was set up by an outsider.
Counters T1114.003
The advisory says to use supported versions, apply security updates promptly and run anti-virus.
Counters T1566.001
The advisory says UK organizations and individuals can report related suspicious activity to the NCSC.
Counters T1566.002
Follow what governments and MITRE report about this group and compare its listed techniques with your email and sign-in controls.
Find look-alike domains and fake sign-in pages that imitate your organization, since the advisory says the group registers domains resembling legitimate organizations.
Spot fake profiles and impersonation of your senior people and experts, since the advisory describes fake profiles and spoofed contacts.
Watch for leaked or sold company and personal email credentials, since the group's method is to harvest logins.
The UK, US, Australian, Canadian and New Zealand cyber agencies assess that it is almost certainly subordinate to Russia's FSB Center 18 (7 December 2023). MITRE says it has been active since at least 2019 and lists SEABORGIUM, Callisto Group, TA446 and COLDRIVER as associated names.
MITRE describes a cyber espionage and influence group. The UK says it gathered information and has selectively leaked and amplified stolen material in line with Russian confrontation goals.
The advisory describes spearphishing: fake contacts, a slow build of trust, then a link to a fake sign-in page. Stolen logins and session cookies give access to email, and forwarding rules keep that access.
Yes. On 7 December 2023 the US Department of Justice unsealed an indictment of Ruslan Aleksandrovich Peretyatko and Andrey Stanislavovich Korinets. The UK and US sanctioned both, and Rewards for Justice offers up to $10 million. An indictment is an allegation.
MITRE's entry was last modified on 31 July 2026 and lists the use of a WhatsApp linked devices feature. The latest government items opened for this page are the 3 October 2024 domain seizure and the December 2023 advisory, which says the activity was continuing through 2023.
Protect email accounts with multi-factor authentication and strong separate passwords, disable or monitor mail forwarding, and verify unexpected contact through another channel.
Take control of your digital security with an exclusive demo of our AI-driven threat intelligence platform.