Skip to content

Star Blizzard

IntrusionSet · ATTACK:enterprise:G1033

Attributed source ↗ · Plaintext record · Complete record and assertions JSON

Inspect structured metadata and provenance

{
  "id": "ATTACK:enterprise:G1033",
  "title": "Star Blizzard",
  "type": "IntrusionSet",
  "source_url": "https://attack.mitre.org/groups/G1033",
  "snapshot": "enterprise-attack-20.0.json",
  "status": "active",
  "rights": "Source metadata only; source notices retained; no operational prose or payloads",
  "review_status": "machine-extracted; source-specific checks passed, editorial review pending",
  "stix_id": "intrusion-set--9b36c218-4d80-4ec6-a68d-cc2886bbe410",
  "external_id": "G1033",
  "domain": "enterprise",
  "created": "2024-06-14T18:17:18.727Z",
  "modified": "2026-07-31T20:48:42.370Z",
  "version": "2.0",
  "aliases": [
    "Star Blizzard",
    "SEABORGIUM",
    "Callisto Group",
    "TA446",
    "COLDRIVER"
  ],
  "tactics": [

  ],
  "source_references": [
    {
      "source_name": "Callisto Group"
    },
    {
      "source_name": "TA446"
    },
    {
      "source_name": "COLDRIVER"
    },
    {
      "source_name": "SEABORGIUM"
    },
    {
      "source_name": "CISA Star Blizzard Advisory December 2023",
      "url": "https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-341a"
    },
    {
      "source_name": "Microsoft Star Blizzard August 2022",
      "url": "https://www.microsoft.com/en-us/security/blog/2022/08/15/disrupting-seaborgiums-ongoing-phishing-operations/"
    },
    {
      "source_name": "StarBlizzard",
      "url": "https://www.microsoft.com/en-us/security/blog/2023/12/07/star-blizzard-increases-sophistication-and-evasion-in-ongoing-attacks/"
    },
    {
      "source_name": "Google TAG COLDRIVER January 2024",
      "url": "https://blog.google/threat-analysis-group/google-tag-coldriver-russian-phishing-malware/"
    }
  ]
}

Explicit source assertions (21)

First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.

ATTACK:enterprise:G1033 → uses → ATTACK:enterprise:T1684.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--006e52ca-80ac-458a-943e-0595f570fe73

CISA Star Blizzard Advisory December 2023 · Microsoft Star Blizzard August 2022 · Google TAG COLDRIVER January 2024

ATTACK:enterprise:G1033 → uses → ATTACK:enterprise:T1583.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--2e13c903-72e3-4ed7-a4b5-8441793a36e6

CISA Star Blizzard Advisory December 2023 · StarBlizzard

ATTACK:enterprise:G1033 → uses → ATTACK:enterprise:T1114.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--38961818-2eae-4f78-860b-9995dec10829

CISA Star Blizzard Advisory December 2023

ATTACK:enterprise:G1033 → uses → ATTACK:enterprise:T1550.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--448c477c-3a30-43eb-b9a2-e9ffc8dca984

CISA Star Blizzard Advisory December 2023

ATTACK:enterprise:G1033 → uses → ATTACK:enterprise:T1204.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--4e7d7d9e-c3d5-4a9d-a948-d50724932321

Google TAG COLDRIVER January 2024

ATTACK:enterprise:G1033 → uses → ATTACK:enterprise:S1140

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--516e6ace-278b-46cf-97df-1345572f3467

Google TAG COLDRIVER January 2024

ATTACK:enterprise:G1033 → uses → ATTACK:enterprise:T1608.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--52f444aa-ef68-4c26-b0a4-3dbc568eae63

Google TAG COLDRIVER January 2024

ATTACK:enterprise:G1033 → uses → ATTACK:enterprise:T1539

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--55409bd6-f45c-479c-9557-d8efff292789

CISA Star Blizzard Advisory December 2023

ATTACK:enterprise:G1033 → uses → ATTACK:enterprise:T1589

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--74f411db-11a3-4c24-af5a-8068ab0da7cc

CISA Star Blizzard Advisory December 2023

ATTACK:enterprise:G1033 → uses → ATTACK:enterprise:T1585.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--78dd8fdb-51c9-475b-af74-0acd1c0a0969

CISA Star Blizzard Advisory December 2023 · Microsoft Star Blizzard August 2022 · Google TAG COLDRIVER January 2024

ATTACK:enterprise:G1033 → uses → ATTACK:enterprise:T1566.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--8589a293-b318-4028-865c-7c5e5554aa60

Google TAG COLDRIVER January 2024

ATTACK:enterprise:G1033 → uses → ATTACK:enterprise:T1598.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--8b02e229-c01f-47d0-8f37-03871ef0a608

CISA Star Blizzard Advisory December 2023 · Microsoft Star Blizzard August 2022 · StarBlizzard · Google TAG COLDRIVER January 2024

ATTACK:enterprise:G1033 → uses → ATTACK:enterprise:T1598.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--af6b077e-6925-4551-8174-baee6efa050c

CISA Star Blizzard Advisory December 2023 · Microsoft Star Blizzard August 2022 · StarBlizzard · Google TAG COLDRIVER January 2024

ATTACK:enterprise:G1033 → uses → ATTACK:enterprise:T1588.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--c1340ca5-8aa5-442b-8715-b2c9a525d14f

CISA Star Blizzard Advisory December 2023 · StarBlizzard

ATTACK:enterprise:G1033 → uses → ATTACK:enterprise:T1583

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--c430932c-65d1-4f27-994b-fdf39220e530

ATTACK:enterprise:G1033 → uses → ATTACK:enterprise:T1114.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--d53397d8-02c7-4d31-a512-8b0226e38d6e

CISA Star Blizzard Advisory December 2023 · Microsoft Star Blizzard August 2022

ATTACK:enterprise:G1033 → uses → ATTACK:enterprise:T1585.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--e86f6977-8dc6-4d5d-9d87-a6ace0058642

CISA Star Blizzard Advisory December 2023 · Microsoft Star Blizzard August 2022

ATTACK:enterprise:G1033 → uses → ATTACK:enterprise:T1078

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--e99ebaf9-e899-4339-b8db-2a98e5476cd4

CISA Star Blizzard Advisory December 2023 · Microsoft Star Blizzard August 2022

ATTACK:enterprise:G1033 → uses → ATTACK:enterprise:T1586.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--f2089e12-e97c-4b78-92fc-c5476faa43a9

CISA Star Blizzard Advisory December 2023

ATTACK:enterprise:G1033 → uses → ATTACK:enterprise:T1059.007

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--f3ac1fad-7d60-48a3-8cb0-6b778987d333

ATTACK:enterprise:G1033 → uses → ATTACK:enterprise:T1593

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--fd7bcf0a-5546-4c0d-adcc-aff6963d06f5

CISA Star Blizzard Advisory December 2023 · Microsoft Star Blizzard August 2022

Provided as is, for information only, with no warranty and no liability. Not legal or professional advice. Security and radio material is for authorized, lawful use only. Full disclaimer.

Visits are logged on our own server: IP address, browser and device details, and pages viewed. We use them to understand traffic and spot attacks, and never share or sell them.