Star Blizzard
aka COLDRIVER, Callisto Group, SEABORGIUM, TA446, UNC4057, BlueCharlie
A group tied to Russia's FSB that poses as acquaintances in email to steal passwords from officials, researchers, NGOs and journalists in NATO countries. Since 2025 it also uses malware that steals documents.
- Alert level
- 1/ 5
- Reports & advisories (90 days)
- 0
- Known exploited CVEs
- 0
- Personal data leaked (disclosed)
- None confirmed
Attribution
- Assessed as almost certainly subordinate to Russia's FSB Centre 18 — UK NCSC, US CISA, NSA, FBI and partners
- Assessed as Russian government-backed — Google Threat Intelligence Group
How they attack
Entry
Building trust as a fake contact
Like trading a few friendly letters as a fake acquaintance before steering the target to a fake front desk.
Entry
Fake 'I'm not a robot' checks
Like being told to 'read this phrase to verify yourself' and ending up reciting your own safe code.
Inside
Setting up silent mail forwarding
Like filing a secret mail-forwarding order so copies of every letter also arrive at the spy's address.
Goal
Leaking stolen material to sway opinion
Like mailing selected stolen letters to the press to damage someone's reputation.
Sources
Attributions are quoted as assessed by governments and security vendors. VulnPulse does not make attributions itself.
Leak counts only add up figures disclosed by the affected companies or authorities, never the attackers' own claims. We do not list victim names or link to leak sites.
The alert level is calculated automatically from reports and advisories in the last 90 days, known exploited vulnerabilities, and whether the group has targeted Japan.
Updated 2026-10-23 · daily