Star Blizzard

Reported Context (11)

The article attributes persistent spear-phishing, credential and data theft, malware delivery, and espionage activity to the group; it reports that public attribution links it to FSB Centre 18. CYFIRMA Profiles Star Blizzard’s RedFlick Campaigns and Evolving Tradecraft
Russia-aligned threat actor reported to have used DarkSword with fake invitation lures; the article identifies COLDRIVER as an alias. P7 DarkSword iOS Exploit Kit Adds Crypto Wallet Theft and Remote Commands
The article attributes the RedFlick delivery method and CosmicPulse deployment to this Russian state actor. Star Blizzard Uses RedFlick to Deploy CosmicPulse Backdoor Through Phishing
Russian state-sponsored APT reported to use the RedFlick infection chain in attacks. Star Blizzard Uses RedFlick Infection Chain in Recent Attacks
Microsoft identifies this FSB-affiliated group as conducting the phishing campaigns. Star Blizzard Expands Phishing Campaigns With RedFlick and CosmicPulse

Malware (14)

People (8)

Threat Actors (12)

MITRE ATT&CK (58)

Vendors (6)

Products (30)

Tools (2)

Industries (25)

Countries (15)

Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.