Adversary Unmasked APT Profile · Star Blizzard

Star Blizzard is a Russian espionage group linked to the Federal Security Service Centre 18, targeting government, defense, NGOs, and academia mainly in the UK, US, Ukraine, and NATO countries. The group uses spear-phishing, impersonation, and relationship building to steal credentials and conduct hack-and-leak operations. Since 2024, they have expanded to deploying endpoint malware including SPICA, YESROBOT, MAYBEROBOT, and CosmicPulse backdoors. Their tactics evolved from targeted to bulk phishing campaigns using fake CAPTCHA lures and exploiting iOS devices with the DarkSword exploit kit. They also use compromised WordPress sites for infrastructure and rapidly develop new malware variants after exposure. Recent campaigns have targeted over 100 organizations with the RedFlick delivery chain, showing increased scale and sophistication.

• To Be (A Robot) or Not to Be: New Malware Attributed to Russia State-Sponsored COLDRIVERMalware2025-10-21
• Star Blizzard refines phishing and malware delivery with the RedFlick techniqueMalware2026-09-30
• Updates Arsenal with BAITSWITCH and SIMPLEFIXMalware2025-09-24
• COLDRIVER Using New Malware To Steal Documents From Western Targets and NGOsMalware2025-05-07
• Mind the (Patch) Gap, Part 2: Fake Websites Used to Deploy Chrome & Windows 0-Day ExploitsMalware2026-09-23