Star Blizzard Threat Actor Profile: Espionage Tactics and Tools

Summary

Star Blizzard, also tracked as SEABORGIUM, is a persistent Russian-aligned threat actor conducting espionage through credential theft and data collection. The group uses advanced phishing techniques, including adversary-in-the-middle kits and malicious VHDX files, to compromise individuals of political interest. Recent activity shows a shift from credential-focused operations toward deploying endpoint malware such as the CosmicPulse backdoor.

Investigation

The report outlines Star Blizzard’s evolution from basic mailbox credential theft to more sophisticated endpoint exploitation and mobile targeting. Investigations highlight the RedFlick delivery chain and exploitation involving the DarkSword iOS kit. Analysts have also observed a transition from highly targeted one-to-one spear-phishing toward broader bulk phishing campaigns.

Mitigation

Key mitigations include enforcing phishing-resistant MFA such as FIDO2 and updating iOS devices to version 26.3 or later. Organizations should restrict VHD and VHDX mounting where unnecessary and limit outbound SSH from user workstations. Monitoring for suspicious mailbox forwarding rules and unauthorized scheduled tasks is also critical.

Response

When Star Blizzard activity is detected, organizations should immediately investigate potential session cookie theft and account compromise. For endpoint infections, isolate affected devices and conduct forensic analysis of newly created scheduled tasks and unusual Python or PowerShell execution. Review mailbox forwarding rules for unauthorized or suspicious changes.

Simulation Execution

• Attack Narrative & Commands: The adversary has gained initial access to the victim’s workstation. To maintain a stealthy presence and facilitate command-and-control (C2) communication, they need a place to store encrypted configuration fragments. Instead of dropping a file on disk which might be flagged by AV, they choose to utilize the Windows Registry. Specifically, they mimic the Star Blizzard technique of creating a subkey under HKCUSoftwareClasses.mollis. This allows them to store small, fragmented pieces of encrypted data that are later reconstructed in memory, making forensic reconstruction of the full payload significantly more difficult.

• Regression Test Script:

  # Simulation of Star Blizzard Registry Key Creation
  $registryPath = "HKCU:SoftwareClasses.mollis"
  $valueName = "ConfigFragment"
  # Simulated encrypted fragment (Base64 encoded)
  $encryptedData = "SGVsbG8gV29ybGQhIFRoaXMgaXMgYSBzaW11bGF0ZWQgZW5jcnlwdGVkIGZyYWdtZW50Lg=="
  
  Write-Host "[*] Simulating Star Blizzard activity..." -ForegroundColor Cyan
  
  if (-not (Test-Path $registryPath)) {
      New-Item -Path $registryPath -Force | Out-Null
      Write-Host "[+] Created Registry Key: $registryPath" -ForegroundColor Green
  }
  
  Set-ItemProperty -Path $registryPath -Name $valueName -Value $encryptedData
  Write-Host "[+] Wrote encrypted fragment to: $registryPath$valueName" -ForegroundColor Green
  Write-Host "[*] Simulation complete. Check SIEM for detection." -ForegroundColor Yellow

• Cleanup Commands:

  # Cleanup the simulated registry key
  Remove-Item -Path "HKCU:SoftwareClasses.mollis" -Recurse -Force
  Write-Host "[*] Cleanup complete. Registry key removed." -ForegroundColor Cyan