Skip to content
Star Blizzard APT Escalates Espionage Tactics with New Malware

Star Blizzard APT Escalates Espionage Tactics with New Malware

First seen 3 Nov 2026, 22:45 UTC • •
API

Article Content

Browse articles
ThreatCluster AI
ThreatCluster •November 3, 2026 at 22:46 UTC
  • •Star Blizzard is a Russian-aligned APT group focusing on espionage through credential theft.
  • •Recent tactics include deploying the CosmicPulse backdoor and using advanced phishing techniques.
  • •Organizations should enforce phishing-resistant MFA and update iOS devices to mitigate risks.

Star Blizzard, also known as SEABORGIUM, is a Russian-aligned APT group engaged in espionage through credential theft and data collection. Recent activities indicate a shift from credential-focused attacks to deploying endpoint malware, notably the CosmicPulse backdoor. The group employs advanced phishing techniques, including adversary-in-the-middle kits and malicious VHDX files, targeting individuals of political interest. Investigations reveal the use of the RedFlick delivery chain and the DarkSword iOS kit, with a transition from targeted spear-phishing to broader bulk phishing campaigns. Key mitigations include enforcing phishing-resistant MFA and updating iOS devices to version 26.3 or later. Organizations are advised to monitor for suspicious mailbox forwarding rules and unauthorized scheduled tasks, and to isolate infected devices for forensic analysis. The adversary's tactics include storing encrypted data fragments in the Windows Registry to evade detection.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated 6h ago How this analysis works

Timeline

Recent
Star Blizzard activity reported
The group has shifted tactics from credential theft to deploying endpoint malware and broader phishing campaigns.
Socprime
Recent
Key mitigations recommended
Organizations advised to implement phishing-resistant MFA and restrict VHD/VHDX mounting to enhance security.
Socprime

More articles in this cluster (2)

Following this threat?

Track Seaborgium and CosmicPulse in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Extracted Entities (19)

1 / 3

Common questions

What are the main attack methods used by Star Blizzard?
Star Blizzard uses advanced phishing techniques, including adversary-in-the-middle kits and malicious VHDX files.
What should organizations do to protect against these attacks?
Organizations should enforce phishing-resistant MFA and monitor for suspicious mailbox activity.
Is there confirmed exploitation of the CosmicPulse backdoor?
The articles do not confirm active exploitation of the CosmicPulse backdoor, but it is a significant concern.