Star Blizzard APT Profile: Tactics, Tools, and Operations

Summary

Star Blizzard, also tracked as SEABORGIUM, is a persistent Russian-aligned threat actor conducting espionage through credential theft and data collection. The group relies on advanced phishing techniques, including adversary-in-the-middle kits and malicious VHDX files, to compromise individuals of political interest. Recent activity shows an evolution from credential-focused attacks toward endpoint malware deployment, including the CosmicPulse backdoor.

Investigation

The report traces Star Blizzard’s evolution from straightforward mailbox credential theft to more complex endpoint exploitation and mobile targeting. Investigations highlight the use of the RedFlick delivery chain and exploitation involving the DarkSword iOS kit. Analysts have also observed a shift from highly targeted one-to-one spear-phishing toward broader bulk phishing campaigns.

Mitigation

Key mitigations include enforcing phishing-resistant MFA such as FIDO2 and updating iOS devices to version 26.3 or later. Organizations should block VHD and VHDX mounting where unnecessary and restrict outbound SSH from user workstations. Monitoring for suspicious mailbox forwarding rules and unauthorized scheduled tasks is also essential.

Response

When Star Blizzard activity is detected, organizations should immediately investigate potential session cookie theft and account compromise. For endpoint infections, isolate affected devices and perform forensic analysis of newly created scheduled tasks and unusual Python or PowerShell execution. Review all mailbox forwarding rules for unauthorized or suspicious modifications.

Simulation Execution

• Attack Narrative & Commands: The adversary has gained initial access to the victim’s workstation. To maintain a stealthy presence and facilitate command-and-control (C2) communication, they need a place to store encrypted configuration fragments. Instead of dropping a file on disk which might be flagged by AV, they choose to utilize the Windows Registry. Specifically, they mimic the Star Blizzard technique of creating a subkey under HKCUSoftwareClasses.mollis. This allows them to store small, fragmented pieces of encrypted data that are later reconstructed in memory, making forensic reconstruction of the full payload significantly more difficult.

• Regression Test Script:

  # Simulation of Star Blizzard Registry Key Creation
  $registryPath = "HKCU:SoftwareClasses.mollis"
  $valueName = "ConfigFragment"
  # Simulated encrypted fragment (Base64 encoded)
  $encryptedData = "SGVsbG8gV29ybGQhIFRoaXMgaXMgYSBzaW11bGF0ZWQgZW5jcnlwdGVkIGZyYWdtZW50Lg=="
  
  Write-Host "[*] Simulating Star Blizzard activity..." -ForegroundColor Cyan
  
  if (-not (Test-Path $registryPath)) {
      New-Item -Path $registryPath -Force | Out-Null
      Write-Host "[+] Created Registry Key: $registryPath" -ForegroundColor Green
  }
  
  Set-ItemProperty -Path $registryPath -Name $valueName -Value $encryptedData
  Write-Host "[+] Wrote encrypted fragment to: $registryPath$valueName" -ForegroundColor Green
  Write-Host "[*] Simulation complete. Check SIEM for detection." -ForegroundColor Yellow

• Cleanup Commands:

  # Cleanup the simulated registry key
  Remove-Item -Path "HKCU:SoftwareClasses.mollis" -Recurse -Force
  Write-Host "[*] Cleanup complete. Registry key removed." -ForegroundColor Cyan