Star Blizzard
MITRE G1016Also known as Coldriver, Callisto, BlueCharlie, COLDRIVER, Star Blizzard, Callisto Group, FANCY BEAR, SEABORGIUM, TA446
Reports
11
First seen
Nov 1, 2025
Last seen
Oct 5, 2026
Motivation
Espionage
Relationships
Filled ◆ = CVE exploited in the wild. Entities that appear together in Signalis reporting — co-mention, not confirmed collaboration. Reports naming many actors at once (weekly roundups) are excluded from relationship edges.
Targeting
Sectors
Victim regions
×1×1
Ukraine×1
United States×1
Victim country, only when stated. Corpus is predominantly English-language reporting, so US/EU coverage is overweighted relative to true victim distribution.
Top ATT&CK techniques
T1566 Phishing ×11T1053 Scheduled Task/Job ×6T1190 Exploit Public-Facing Application ×5T1566.001 Phishing: Spearphishing Attachment ×4T1204 User Execution ×4T1566.002 Phishing: Spearphishing Link ×4T1005 Data from Local System ×4T1486 Data Encrypted for Impact ×4T1041 Exfiltration Over C2 Channel ×3T1078 Valid Accounts ×3T1547 Boot or Logon Autostart Execution ×3T1218 System Binary Proxy Execution ×3
Indicators
cve ×153domain ×25filename ×12ip_v4 ×7hash_sha256 ×5url ×3registry_key ×1
Indicator values are available on Pro and via the API.
Associated CVEs
CVE-2020-12812 (exploited)CVE-2021-26829 (exploited)CVE-2025-14174 (exploited)CVE-2025-27915 (exploited)CVE-2025-41244 (exploited)CVE-2025-43529 (exploited)CVE-2025-55182 (exploited)CVE-2025-59718 (exploited)CVE-2025-59719 (exploited)CVE-2026-102331CVE-2026-104286 (exploited)CVE-2026-76504 (exploited)CVE-2026-81578 (exploited)CVE-2026-82078 (exploited)CVE-2026-86950 (exploited)CVE-2026-88771 (exploited)CVE-2026-88772 (exploited)CVE-2026-88779 (exploited)CVE-2026-90970CVE-2026-93485
Recent reports
High