{
  "id": "star-blizzard",
  "name": "Star Blizzard",
  "aliases": [
    "SEABORGIUM",
    "Callisto Group",
    "TA446",
    "COLDRIVER"
  ],
  "domain": "cyber",
  "country": "RUS",
  "category": "Suspected state-linked cyber threat group",
  "status": "tracked",
  "fielded": null,
  "operators": [
    "RUS"
  ],
  "summary": "Star Blizzard is a cyber espionage and influence group originating in Russia that has been active since at least 2019. Star Blizzard campaigns align closely with Russian state interests and have included persistent phishing and credential theft against academic, defense, government, NGO, and think tank organizations in NATO countries, particularly the US and the UK.",
  "specs": [
    {
      "k": "sponsor",
      "v": "Originates in Russia",
      "src": [
        "mitre-g1033"
      ],
      "conf": "medium"
    },
    {
      "k": "active_since",
      "v": 2019,
      "src": [
        "mitre-g1033"
      ],
      "conf": "medium",
      "note": "At least 2019"
    },
    {
      "k": "attack_id",
      "v": "G1033",
      "src": [
        "mitre-g1033"
      ],
      "conf": "high"
    },
    {
      "k": "techniques_count",
      "v": 20,
      "src": [
        "mitre-g1033"
      ],
      "conf": "high",
      "note": "ATT&CK v20.1"
    },
    {
      "k": "software",
      "v": "Spica",
      "src": [
        "mitre-g1033"
      ],
      "conf": "high",
      "note": "1 malware and tool entries linked in ATT&CK"
    }
  ],
  "payloads": [],
  "variants": [],
  "art": "cyber",
  "image": null,
  "verified": null,
  "notes": "Star Blizzard is a cyber espionage and influence group originating in Russia that has been active since at least 2019. Star Blizzard campaigns align closely with Russian state interests and have included persistent phishing and credential theft against academic, defense, government, NGO, and think tank organizations in NATO countries, particularly the US and the UK. Description adapted from MITRE ATT&CK®, © The MITRE Corporation, used under the ATT&CK Terms of Use.",
  "changelog": [
    {
      "date": "2026-11-08",
      "change": "Entry created from MITRE ATT&CK Enterprise v20.1 (group G1033)"
    }
  ],
  "url": "https://www.defensepedia.com/systems/star-blizzard.html",
  "sources": {
    "mitre-g1033": {
      "title": "Star Blizzard, Group G1033",
      "publisher": "MITRE ATT&CK",
      "url": "https://attack.mitre.org/groups/G1033/",
      "published": "2026-07-31",
      "tier": 2,
      "checked": "2026-11-08"
    }
  }
}