{
  "name": "Adversary Atlas API",
  "version": "1.0.0",
  "description": "Read-only JSON API over the Adversary Atlas threat actor dataset. Statically generated at build time; no authentication, no rate limits.",
  "generated": "2026-07-31T01:06:07.226Z",
  "datasetCurrentAsOf": "2025-09-01",
  "license": "Data compiled from public primary sources; see /methodology/ for sourcing.",
  "actor": {
    "id": "star-blizzard",
    "slug": "star-blizzard",
    "name": "Star Blizzard",
    "shortName": "Star Blizzard",
    "country": "Russia",
    "countryCode": "RU",
    "sponsorship": "state-sponsored",
    "status": "active",
    "activeSince": "2015",
    "prominence": 78,
    "mitreGroupId": "G1033",
    "malpediaSlug": "callisto",
    "tagline": "FSB Centre 18 credential phishing against academics, journalists, NGOs, and former intelligence officials — with hack-and-leak as the follow-through.",
    "bio": "Star Blizzard runs one of the most persistent credential-phishing operations attributed to any state service, and it is notable less for technical capability than for the care put into social engineering.\n\nOperators build rapport before ever sending a malicious link. They impersonate known colleagues of the target, open with an innocuous message referencing a genuine shared interest or upcoming conference, exchange several benign emails, and only then send a document link leading to an Evilginx-style adversary-in-the-middle proxy that captures both credentials and the session cookie — defeating most MFA implementations.\n\nThe targeting is politically specific: academics researching Russia, journalists covering the war, NGOs and human rights organisations, defence policy think tanks, and — repeatedly — former senior intelligence and diplomatic officials. Several operations have culminated in hack-and-leak: in 2022 the mailbox of a former MI6 chief was compromised and material published through a fabricated leak site.\n\nIn December 2023 the UK sanctioned and the U.S. indicted two individuals, naming Ruslan Peretyatko as an officer of FSB Centre 18. Microsoft and the U.S. Department of Justice seized 107 domains in a joint civil action in October 2024, though the group re-established infrastructure within months.",
    "attribution": {
      "sponsor": "Russia",
      "service": "FSB — Federal Security Service",
      "unit": "Centre 18",
      "unitDetail": "Centre for Information Security, FSB",
      "confidence": "confirmed",
      "summary": "The UK Foreign, Commonwealth and Development Office sanctioned two individuals in December 2023, identifying Ruslan Aleksandrovich Peretyatko as an officer of FSB Centre 18 and Andrey Stanislavovich Korinets as a co-participant. The U.S. Department of Justice unsealed a parallel indictment the same day. Microsoft and the DOJ subsequently seized over one hundred domains used by the group in an October 2024 civil action.",
      "sources": [
        {
          "org": "UK Foreign, Commonwealth & Development Office / NCSC",
          "title": "UK exposes attempted Russian cyber interference in politics and democratic processes",
          "url": "https://www.gov.uk/government/news/uk-exposes-attempted-russian-cyber-interference-in-politics-and-democratic-processes",
          "date": "2023-12-07"
        },
        {
          "org": "U.S. Department of Justice",
          "title": "Two Russian Nationals Charged in Connection with Global Spear-Phishing Campaign",
          "url": "https://www.justice.gov/opa/pr/two-russian-nationals-working-federal-security-service-charged-global-computer-intrusion",
          "date": "2023-12-07"
        },
        {
          "org": "Microsoft / U.S. Department of Justice",
          "title": "Microsoft and DOJ seize 107 domains used by Star Blizzard",
          "url": "https://blogs.microsoft.com/on-the-issues/2024/10/03/star-blizzard-hack-russia/",
          "date": "2024-10-03"
        }
      ]
    },
    "motivations": [
      "espionage",
      "information-operations"
    ],
    "targetSectors": [
      "Think Tanks & Academia",
      "NGO & Civil Society",
      "Media & Journalism",
      "Government",
      "Defense",
      "Political Organizations"
    ],
    "targetCountries": [
      "United Kingdom",
      "United States",
      "Ukraine",
      "Germany",
      "Poland",
      "Baltic states"
    ],
    "aliases": [
      {
        "org": "mitre",
        "name": "Star Blizzard",
        "url": "https://attack.mitre.org/groups/G1033/",
        "correlation": "exact"
      },
      {
        "org": "microsoft",
        "name": "Star Blizzard",
        "correlation": "exact",
        "note": "Formerly SEABORGIUM"
      },
      {
        "org": "microsoft",
        "name": "SEABORGIUM",
        "correlation": "exact",
        "note": "Retired designator"
      },
      {
        "org": "crowdstrike",
        "name": "Gossamer Bear",
        "correlation": "exact"
      },
      {
        "org": "mandiant",
        "name": "UNC4057",
        "correlation": "exact"
      },
      {
        "org": "mandiant",
        "name": "COLDRIVER",
        "correlation": "exact",
        "note": "Google Threat Intelligence designator"
      },
      {
        "org": "recordedfuture",
        "name": "BlueCharlie",
        "correlation": "exact"
      },
      {
        "org": "recordedfuture",
        "name": "TAG-53",
        "correlation": "exact",
        "note": "Earlier provisional designator"
      },
      {
        "org": "proofpoint",
        "name": "TA446",
        "correlation": "exact"
      },
      {
        "org": "cisa",
        "name": "Callisto Group",
        "correlation": "exact"
      }
    ],
    "tools": [
      {
        "name": "Evilginx",
        "type": "framework",
        "custom": false,
        "description": "Open-source adversary-in-the-middle phishing proxy that captures session cookies alongside credentials, defeating most MFA."
      },
      {
        "name": "SPICA",
        "type": "backdoor",
        "custom": true,
        "description": "Rust backdoor delivered via a decoy PDF that appears encrypted; the group's first confirmed custom malware, disclosed by Google TAG in 2024.",
        "malpediaSlug": "win.spica"
      },
      {
        "name": "LOSTKEYS",
        "type": "malware",
        "custom": true,
        "description": "File-stealer delivered through a fake CAPTCHA 'ClickFix' lure that persuades the target to paste a PowerShell command themselves."
      },
      {
        "name": "HYPERSCRAPE",
        "type": "utility",
        "custom": true,
        "description": "Mailbox scraping tool that authenticates with a stolen session, downloads mail, and reverts read-status flags to hide the theft."
      }
    ],
    "techniques": [
      {
        "tCode": "T1585.002",
        "name": "Establish Accounts: Email Accounts",
        "tactic": "Resource Development",
        "note": "Personas impersonating known colleagues of the target"
      },
      {
        "tCode": "T1598.003",
        "name": "Phishing for Information: Spearphishing Link",
        "tactic": "Reconnaissance",
        "note": "Multi-message benign rapport-building before any malicious link"
      },
      {
        "tCode": "T1566.002",
        "name": "Phishing: Spearphishing Link",
        "tactic": "Initial Access"
      },
      {
        "tCode": "T1557",
        "name": "Adversary-in-the-Middle",
        "tactic": "Credential Access",
        "note": "Evilginx proxy capturing session cookies"
      },
      {
        "tCode": "T1539",
        "name": "Steal Web Session Cookie",
        "tactic": "Credential Access",
        "note": "Primary MFA bypass mechanism"
      },
      {
        "tCode": "T1114.002",
        "name": "Email Collection: Remote Email Collection",
        "tactic": "Collection"
      },
      {
        "tCode": "T1114.003",
        "name": "Email Collection: Email Forwarding Rule",
        "tactic": "Collection",
        "note": "Persistent mailbox rules surviving password reset"
      },
      {
        "tCode": "T1204.004",
        "name": "User Execution: Malicious Copy and Paste",
        "tactic": "Execution",
        "note": "ClickFix fake-CAPTCHA lure delivering LOSTKEYS"
      },
      {
        "tCode": "T1583.001",
        "name": "Acquire Infrastructure: Domains",
        "tactic": "Resource Development"
      }
    ],
    "cves": [],
    "relationships": [
      {
        "relatedActorId": "apt29",
        "type": "same-sponsor",
        "confidence": "moderate",
        "note": "Overlapping interest in policy and think-tank targets, though a different service and a far lower capability tier."
      },
      {
        "relatedActorId": "turla",
        "type": "same-sponsor",
        "confidence": "high",
        "note": "Both FSB — Centre 18 and Centre 16 respectively."
      }
    ],
    "reports": [
      {
        "org": "Microsoft Threat Intelligence",
        "title": "Disrupting SEABORGIUM's ongoing phishing operations",
        "url": "https://www.microsoft.com/en-us/security/blog/2022/08/15/disrupting-seaborgiums-ongoing-phishing-operations/",
        "date": "2022-08-15"
      },
      {
        "org": "NCSC-UK and partners",
        "title": "Advisory: Star Blizzard continues worldwide spear-phishing campaigns",
        "url": "https://www.ncsc.gov.uk/news/star-blizzard-continues-spear-phishing-campaigns",
        "date": "2023-12-07"
      },
      {
        "org": "Google Threat Analysis Group",
        "title": "Russian threat group COLDRIVER escalates phishing with custom SPICA malware",
        "url": "https://blog.google/threat-analysis-group/google-tag-coldriver-russian-phishing-malware/",
        "date": "2024-01-18"
      },
      {
        "org": "Google Threat Intelligence Group",
        "title": "COLDRIVER using new LOSTKEYS malware",
        "url": "https://cloud.google.com/blog/topics/threat-intelligence/coldriver-steals-documents-western-targets",
        "date": "2025-05-07"
      }
    ],
    "campaigns": [
      {
        "id": "star-blizzard-hackleak",
        "actorId": "star-blizzard",
        "name": "UK Hack-and-Leak Operations",
        "date": "2022-05-01",
        "significance": "notable",
        "targetSectors": [
          "Government",
          "Think Tanks & Academia",
          "NGO & Civil Society",
          "Media & Journalism"
        ],
        "targetCountries": [
          "United Kingdom",
          "United States"
        ],
        "cveIds": [],
        "summary": "Credential phishing against former senior officials, culminating in the compromise of a former MI6 chief's mailbox and publication of the material through a fabricated leak site. Preceded by weeks of benign rapport-building correspondence in each case.",
        "sources": [
          {
            "org": "NCSC-UK and partners",
            "title": "Star Blizzard continues worldwide spear-phishing campaigns",
            "url": "https://www.ncsc.gov.uk/news/star-blizzard-continues-spear-phishing-campaigns",
            "date": "2023-12-07"
          }
        ]
      }
    ],
    "flag": "🇷🇺",
    "profile": "/apt/star-blizzard/"
  }
}