GINC Technology
GINC-APT-0055 · State

Star Blizzard

Also Callisto, Callisto Group, Cold River, DNSpionage, Blue Callisto, BlueCharlie and 15 other names.

Category
State · Attributed to a state or working for one.
Origin
Russia(high confidence)contested
Sponsor
State-sponsored, FSB Centre 18: Centre for Information Security (TsIB)
Motivation
Information theft and espionage
Seen
2013–2026
Status
Active
ATT&CK
G1033 · 21 techniques
Sources
11 sources carry it
Identifier
GINC-APT-0055 · star-blizzard

What it is

Star Blizzard is a cyber espionage and influence group originating in Russia that has been active since at least 2019. Star Blizzard campaigns align closely with Russian state interests and have included persistent phishing and credential theft against academic, defense, government, NGO, and think tank organizations in NATO countries, particularly the US and the UK.

Names

The names each vendor, agency and source gives it. Naming differs by who tracks the actor, so one group carries many.

CrowdStrike
Gossamer Bear
Mandiant
UNC4057
Proofpoint
TA446
PwC
Blue Callisto
Recorded Future
TAG-53
Secureworks
IRON FRONTIER
Other names
Callisto, Callisto Group, Cold River, DNSpionage, BlueCharlie, Calisto, Cobalt Edgewater, COLD RELIC, COLDRIVER, Grey Pro, Mythic Ursa, Nahr el bared, Nahr Elbard, Reuse Team, SEABORGIUM

Attribution

Each attribution is a claim: who makes it, and to whom. Western and Eastern sources are kept apart, as they often disagree.

Western sources

Targets

Countries
Albania, Canada, Cyprus, Egypt, India, Iraq, Jordan, Kuwait, Lebanon, Libya, NATO, Sweden, Ukraine, United Arab Emirates, United States
Sectors
Aviation, Defense, Government, Government Administration, Journalist, Law enforcement, Military, NGOs, Telecommunications, Think Tanks

Tools

The tools and malware families the sources tie to it.

  • Blizzard
  • Coldroot
  • Cyber Eye RAT
  • CyberGate
  • DNSpionage
  • HTTP WEB BACKDOOR
  • Karkoff
  • RCS Galileo
  • Spica
  • UNITEDRAKE

Sources