Home › Threat Actors › Star Blizzard (Callisto Group)
← All Threat Actors
Nation-State high Russia

Star Blizzard (Callisto Group)

Russian Federal Security Service (FSB), Centre 18 (the FSB's internal information security unit). US DoJ unsealed charges in December 2023 against named FSB officer Ruslan Aleksandrovich Peretyatko and operational support figure Andrey Stanislavovich Korinets; UK FCDO sanctioned both. · Intelligence collection / espionage — long-term email account access and document exfiltration, not disruption or sabotage.

Reports 1
Active Since Active for over a decade as of 2026; publicly named by Microsoft as Star Blizzard in 2023
Last Reported 23 Jul 2026
Sectors Targeted government, civil-society, defence, think-tanks, academia, media

Tactics, Techniques & Procedures (TTPs)

  • Months-long LinkedIn persona development (posing as academics, journalists, conference organisers) before any phishing contact
  • Spearphishing leading to credential harvesting rather than malware delivery
  • EvilGinx-style adversary-in-the-middle (AiTM) phishing proxies that capture session tokens live, bypassing TOTP-based 2FA
  • Custom phishing kits mimicking Gmail, Outlook, ProtonMail login pages
  • OAuth consent phishing — tricking victims into granting a malicious OAuth app access, which survives password resets
  • Document lures hosted on Google Drive/OneDrive to improve deliverability and trust
  • Post-compromise inbox monitoring, contact mapping, document exfiltration, and persistent email forwarding rules

Known Targets

Government officials and parliamentary/congressional staff (US, UK, allied governments)Think tanks (Belfer Center, Atlantic Council, Chatham House)Academics in nuclear security/arms control (e.g. Cambridge University)Civil society/NGOs supporting Ukraine and ICC war-crimes prosecutionsInvestigative journalists covering Russia/UkraineDefence industrial base personnel

Analyst Notes

In Dec 2023, Microsoft and the NGO-ISAC obtained a court order seizing 180 Star Blizzard domains; the group rebuilt infrastructure and resumed operations within months. Relies almost entirely on social engineering rather than malware or zero-days, making phishing-resistant MFA (FIDO2/WebAuthn) the single most effective defense.

Also Known As

Callisto GroupCOLDRIVERTA446ColdRiverDancing SalomeRecon 2UNC4057

MITRE ATT&CK Techniques

T1566.002 Phishing: Spearphishing Link T1557 Adversary-in-the-Middle T1528 Steal Application Access Token T1114.003 Email Collection: Email Forwarding Rule T1585.001 Establish Accounts: Social Media Accounts

Intelligence Reports

Analysis governmentcivil-society

Star Blizzard: The FSB's Spearphishing Arm Targeting Civil Society and Government

Star Blizzard — also known as Callisto Group, COLDRIVER, and TA446 — is the FSB's persistent long-term access operation against politicians, journalists, academics, and NGOs. A deep dive into their TTPs, target profile, infrastructure, and defensive implications.

23 Jul 2026 · 12 min read