Star Blizzard

Names and who uses them

• Star BlizzardOur name
• Callisto GroupCISA
• TA446CISA
• COLDRIVERGoogle
• SEABORGIUMMicrosoft

Known techniques

• T1059.007JavaScript
• T1078Valid Accounts
• T1114.002Remote Email Collection
• T1114.003Email Forwarding Rule
• T1204.002Malicious File
• T1539Steal Web Session Cookie
• T1550.004Web Session Cookie
• T1566.001Spearphishing Attachment
• T1583Acquire Infrastructure
• T1583.001Domains
• T1585.001Social Media Accounts
• T1585.002Email Accounts
• T1586.002Email Accounts
• T1588.002Tool
• T1589Gather Victim Identity Information
• T1593Search Open Websites/Domains
• T1598.002Spearphishing Attachment
• T1598.003Spearphishing Link
• T1608.001Upload Malware
• T1684.001Impersonation

Malware and tools used