Star Blizzard: A Persistent and Evolving Cyber Threat

---

Star Blizzard, previously known as SEABORGIUM, has reemerged as a significant threat in the cybersecurity landscape, particularly targeting high-profile individuals in government, diplomacy, and defense policy. With a history dating back to at least 2012, the group has employed advanced and deceptive tactics to harvest sensitive information and compromise security systems. This article provides an overview of the threat, a detailed table summarizing its characteristics, a comprehensive removal guide, and preventive measures to avoid future infections.

---

Overview of the Star Blizzard Threat

Primary Targets:

• Government and diplomatic officials (current and former).
• Researchers in defense policy and international relations, especially those focused on Russia.
• Individuals and organizations assisting Ukraine amid the ongoing conflict with Russia.

Alias Names:
Star Blizzard operates under multiple pseudonyms, including:
Blue Callisto, BlueCharlie (TAG-53), Calisto, COLDRIVER, Dancing Salome, Gossamer Bear, Iron Frontier, TA446, and UNC4057.

Main Tactics:

• Spear-phishing emails containing malicious links.
• AiTM (Adversary-in-The-Middle) attacks using Evilginx-powered pages to bypass 2FA security.
• Phishing attempts through email marketing platforms like HubSpot and MailerLite to evade detection.
• Recent campaigns using WhatsApp phishing schemes with QR codes.

---

Threat Summary

Attribute	Details
Name	Star Blizzard (formerly SEABORGIUM)
First Detected	2012
Aliases	Blue Callisto, Dancing Salome, COLDRIVER, Gossamer Bear, Iron Frontier, TA446, etc.
Primary Targets	Government officials, researchers, NGOs, Ukraine-related entities
Attack Techniques	Spear-phishing, AiTM bypass, WhatsApp account linking exploitation
Recent Campaign	WhatsApp phishing via QR codes and shortened links
Exfiltration Methods	Credential theft, WhatsApp account compromise, browser extensions
Notable Disruptions	Over 180 domains seized by Microsoft and U.S. DoJ (2023–2024)
Preventive Measures	Vigilance with emails, verification of unexpected links or QR codes, use of multi-layered cybersecurity

---

The WhatsApp Phishing Campaign

Star Blizzard’s latest campaign demonstrates their ability to adapt and innovate. This attack begins with a spear-phishing email impersonating a U.S. government official. The email includes a QR code, claiming to lead recipients to a WhatsApp group supporting Ukraine NGOs. The code is intentionally broken, prompting victims to reply.

Once the victim responds, the attackers send a follow-up email with a shortened link (e.g., via t.ly) to the alleged WhatsApp group. However, scanning the QR code on the provided site (e.g., aerofluidthermo.org) links the victim’s WhatsApp account to the attackers, granting unauthorized access to messages and sensitive data.

---

Removal Guide

1. Identify the Infection
   • Look for unusual behavior in your WhatsApp account, such as unknown messages sent or received.
   • Check browser extensions for suspicious additions related to WhatsApp or messaging.
2. Terminate Unauthorized Sessions
   • Open WhatsApp on your phone.
   • Go to Settings > Linked Devices.
   • Review and remove any unknown devices.
3. Change Passwords
   • Reset your email password if the phishing attack included email account compromise.
   • Update your WhatsApp-linked email account password to prevent further access.
4. Scan Your Device
   • Use a trusted anti-malware tool like SpyHunter to scan your system for malicious software or browser extensions.
   • Remove detected threats immediately.
5. Secure Your WhatsApp Account
   • Enable Two-Step Verification in WhatsApp settings to add an additional layer of security.
   • Monitor your account activity regularly.
6. Notify Relevant Authorities: If you’re a government or diplomatic official, report the incident to your organization’s cybersecurity team or relevant authorities.

---

Preventive Measures to Avoid Future Infections

• Verify Email Authenticity:
  Never click on links or scan QR codes from unexpected or unverified emails.
• Enable 2FA Everywhere:
  Two-factor authentication adds an extra layer of security to your accounts, making it harder for attackers to gain access.
• Use Reputable Security Software:
  Tools like SpyHunter can help detect and remove malware, phishing attempts, and other threats.
• Monitor Account Activity:
  Regularly check your accounts for suspicious logins or unauthorized access.
• Educate Yourself and Your Team:
  Stay informed about evolving phishing tactics and share knowledge with colleagues to foster a security-aware environment.
• Avoid Public Wi-Fi for Sensitive Tasks:
  Public networks can be exploited by attackers to intercept sensitive data.
• Regularly Update Software:
  Keep all software and applications up-to-date to patch vulnerabilities.

---

Conclusion

Star Blizzard’s persistence and adaptability underscore the importance of proactive cybersecurity measures. By targeting high-profile individuals and organizations, this group poses a significant threat to global diplomacy and defense. Awareness, vigilance, and the implementation of robust security practices are key to mitigating such risks.

Investing in trusted anti-malware tools like SpyHunter and fostering a culture of cybersecurity awareness can protect against evolving threats like Star Blizzard.