Star Blizzard is a Russian espionage group linked to the Federal Security Service Centre 18, targeting government, defense, NGOs, and academia mainly in the UK, US, Ukraine, and NATO countries. The group uses spear-phishing, impersonation, and relationship building to steal credentials and conduct hack-and-leak operations. Since 2024, they have expanded to deploying endpoint malware including SPICA, YESROBOT, MAYBEROBOT, and CosmicPulse backdoors. Their tactics evolved from targeted to bulk phishing campaigns using fake CAPTCHA lures and exploiting iOS devices with the DarkSword exploit kit. They also use compromised WordPress sites for infrastructure and rapidly develop new malware variants after exposure. Recent campaigns have targeted over 100 organizations with the RedFlick delivery chain, showing increased scale and sophistication.
