Star Blizzard

{
  "id": "ATTACK:mobile:G1033",
  "title": "Star Blizzard",
  "type": "IntrusionSet",
  "source_url": "https://attack.mitre.org/groups/G1033",
  "snapshot": "mobile-attack-20.0.json",
  "status": "active",
  "rights": "Source metadata only; source notices retained; no operational prose or payloads",
  "review_status": "machine-extracted; source-specific checks passed, editorial review pending",
  "stix_id": "intrusion-set--9b36c218-4d80-4ec6-a68d-cc2886bbe410",
  "external_id": "G1033",
  "domain": "mobile",
  "created": "2024-06-14T18:17:18.727Z",
  "modified": "2026-07-31T20:48:42.370Z",
  "version": "2.0",
  "aliases": [
    "Star Blizzard",
    "SEABORGIUM",
    "Callisto Group",
    "TA446",
    "COLDRIVER"
  ],
  "tactics": [

  ],
  "source_references": [
    {
      "source_name": "Callisto Group"
    },
    {
      "source_name": "TA446"
    },
    {
      "source_name": "COLDRIVER"
    },
    {
      "source_name": "SEABORGIUM"
    },
    {
      "source_name": "CISA Star Blizzard Advisory December 2023",
      "url": "https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-341a"
    },
    {
      "source_name": "Microsoft Star Blizzard August 2022",
      "url": "https://www.microsoft.com/en-us/security/blog/2022/08/15/disrupting-seaborgiums-ongoing-phishing-operations/"
    },
    {
      "source_name": "StarBlizzard",
      "url": "https://www.microsoft.com/en-us/security/blog/2023/12/07/star-blizzard-increases-sophistication-and-evasion-in-ongoing-attacks/"
    },
    {
      "source_name": "Google TAG COLDRIVER January 2024",
      "url": "https://blog.google/threat-analysis-group/google-tag-coldriver-russian-phishing-malware/"
    }
  ]
}