Star Blizzard

☆ pin

MITRE G1016Also known as BlueCharlie, Coldriver, Callisto, COLDRIVER, Star Blizzard, Callisto Group

Reports

First seen

Nov 1, 2025

Last seen

Jun 27, 2026

Motivation

Espionage, Espionage, credential collection

Targeting

Sectors

Government ×1

Victim regions

Ukraine ×1

Top ATT&CK techniques

T1566 Phishing ×4T1190 Exploit Public-Facing Application ×3T1598.003 Spearphishing Link ×2T1598 Phishing for Information ×2T1566.002 Phishing: Spearphishing Link ×2T1005 Data from Local System ×2T1486 Data Encrypted for Impact ×2T1195 Supply Chain Compromise ×1T1498 Network Denial of Service ×1T1489 Service Stop ×1T1070.001 Indicator Removal: Clear Windows Event Logs ×1T1598.004 Spearphishing Attachment ×1

Indicators

cve ×9domain ×7filename ×1

Indicator values are available on Pro and via the API.

Associated CVEs

CVE-2020-12812 (exploited)CVE-2021-26829 (exploited)CVE-2025-14174 (exploited)CVE-2025-27915 (exploited)CVE-2025-41244 (exploited)CVE-2025-43529 (exploited)CVE-2025-55182 (exploited)CVE-2025-59718 (exploited)CVE-2025-59719 (exploited)

Recent reports

High

Ukraine and FBI Expose Russian Intelligence Phishing Campaign Targeting Messaging Apps

The Hacker NewsJun 27, 2026 High

Threats to the 2026 FIFA World Cup: Physical Security, Cyber, and Influence Operations Risk Assessment

Recorded Future InsiktJun 4, 2026 High

Cyber Brief December 2025: Espionage, Ransomware, and Infrastructure Attacks Across Europe and Beyond

CERT-EU Threat IntelJan 5, 2026 High

Cyber Brief October 2025 – Espionage, Disruption, Data Breaches, and Supply Chain Threats

CERT-EU Threat IntelNov 1, 2025

This page shows data on a 7-day delay. Free accounts get the full delayed feed; real-time reports, indicators, and the API start at $29/mo.