Star Blizzard

☆ pin

MITRE G1016Also known as Coldriver, Callisto, BlueCharlie, COLDRIVER, Star Blizzard, Callisto Group

Reports

First seen

Nov 1, 2025

Last seen

Jun 27, 2026

Motivation

Espionage

Targeting

Sectors

Government ×1

Victim regions

Ukraine ×1

Top ATT&CK techniques

T1566 Phishing ×4T1190 Exploit Public-Facing Application ×3T1598.003 Spearphishing Link ×2T1566.002 Phishing: Spearphishing Link ×2T1486 Data Encrypted for Impact ×2T1598 Phishing for Information ×2T1005 Data from Local System ×2T1505 Server Software Component ×1T1505.003 Web Shell ×1T1583.001 Domains ×1T1091 Replication Through Removable Media ×1T1078 Valid Accounts ×1

Indicators

cve ×9domain ×7filename ×1

Indicator values are available on Pro and via the API.

Associated CVEs

CVE-2020-12812 (exploited)CVE-2021-26829 (exploited)CVE-2025-14174 (exploited)CVE-2025-27915 (exploited)CVE-2025-41244 (exploited)CVE-2025-43529 (exploited)CVE-2025-55182 (exploited)CVE-2025-59718 (exploited)CVE-2025-59719 (exploited)

Recent reports

High

Ukraine and FBI Expose Russian Intelligence Phishing Campaign Targeting Messaging Apps

The Hacker NewsJun 27, 2026 High

Threats to the 2026 FIFA World Cup: Physical Security, Cyber, and Influence Operations Risk Assessment

Recorded Future InsiktJun 4, 2026 High

Cyber Brief December 2025: Espionage, Ransomware, and Infrastructure Attacks Across Europe and Beyond

CERT-EU Threat IntelJan 5, 2026 High

Cyber Brief October 2025 – Espionage, Disruption, Data Breaches, and Supply Chain Threats

CERT-EU Threat IntelNov 1, 2025

This page shows data on a 7-day delay. Free accounts get the full delayed feed; real-time reports, indicators, and the API start at $29/mo.