Star Blizzard, also tracked as SEABORGIUM, is a persistent Russian-aligned threat actor conducting espionage through credential theft and data collection. The group relies on advanced phishing techniques, including adversary-in-the-middle kits and malicious VHDX files, to compromise individuals of political interest. Recent activity shows an evolution from credential-focused attacks toward endpoint malware deployment, including the CosmicPulse backdoor.
The report traces Star Blizzard’s evolution from straightforward mailbox credential theft to more complex endpoint exploitation and mobile targeting. Investigations highlight the use of the RedFlick delivery chain and exploitation involving the DarkSword iOS kit. Analysts have also observed a shift from highly targeted one-to-one spear-phishing toward broader bulk phishing campaigns.
Key mitigations include enforcing phishing-resistant MFA such as FIDO2 and updating iOS devices to version 26.3 or later. Organizations should block VHD and VHDX mounting where unnecessary and restrict outbound SSH from user workstations. Monitoring for suspicious mailbox forwarding rules and unauthorized scheduled tasks is also essential.
When Star Blizzard activity is detected, organizations should immediately investigate potential session cookie theft and account compromise. For endpoint infections, isolate affected devices and perform forensic analysis of newly created scheduled tasks and unusual Python or PowerShell execution. Review all mailbox forwarding rules for unauthorized or suspicious modifications.
Attack Narrative & Commands: The adversary has gained initial access to the victim’s workstation. To maintain a stealthy presence and facilitate command-and-control (C2) communication, they need a place to store encrypted configuration fragments. Instead of dropping a file on disk which might be flagged by AV, they choose to utilize the Windows Registry. Specifically, they mimic the Star Blizzard technique of creating a subkey under HKCUSoftwareClasses.mollis . This allows them to store small, fragmented pieces of encrypted data that are later reconstructed in memory, making forensic reconstruction of the full payload significantly more difficult.
Attack Narrative & Commands: The adversary has gained initial access to the victim’s workstation. To maintain a stealthy presence and facilitate command-and-control (C2) communication, they need a place to store encrypted configuration fragments. Instead of dropping a file on disk which might be flagged by AV, they choose to utilize the Windows Registry. Specifically, they mimic the Star Blizzard technique of creating a subkey under HKCUSoftwareClasses.mollis . This allows them to store small, fragmented pieces of encrypted data that are later reconstructed in memory, making forensic reconstruction of the full payload significantly more difficult.
Regression Test Script: # Simulation of Star Blizzard Registry Key Creation $registryPath = "HKCU:SoftwareClasses.mollis" $valueName = "ConfigFragment" # Simulated encrypted fragment (Base64 encoded) $encryptedData = "SGVsbG8gV29ybGQhIFRoaXMgaXMgYSBzaW11bGF0ZWQgZW5jcnlwdGVkIGZyYWdtZW50Lg==" Write-Host "[*] Simulating Star Blizzard activity..." -ForegroundColor Cyan if (-not (Test-Path $registryPath)) { New-Item -Path $registryPath -Force | Out-Null Write-Host "[+] Created Registry Key: $registryPath" -ForegroundColor Green } Set-ItemProperty -Path $registryPath -Name $valueName -Value $encryptedData Write-Host "[+] Wrote encrypted fragment to: $registryPath$valueName" -ForegroundColor Green Write-Host "[*] Simulation complete. Check SIEM for detection." -ForegroundColor Yellow
Regression Test Script:
Cleanup Commands: # Cleanup the simulated registry key Remove-Item -Path "HKCU:SoftwareClasses.mollis" -Recurse -Force Write-Host "[*] Cleanup complete. Registry key removed." -ForegroundColor Cyan
Join SOC Prime's Detection as Code platform to improve visibility into threats most relevant to your business. To help you get started and drive immediate value, book a meeting now with SOC Prime experts.
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
