Overview 475 indicators
Star Blizzard is a cyber espionage and influence group originating in Russia that has been active since at least 2019. Star Blizzard campaigns align closely with Russian state interests and have included persistent phishing and credential theft against academic, defense, government, NGO, and think tank organizations in NATO countries, particularly the US and the UK.
| domain | 469 | G1033-domain.txt |
| ipv4 | 3 | G1033.json |
| url | 3 | G1033.json |
Techniques 21 ATT&CK
Open in ATT&CK Navigator → or download the layer (21 techniques, layer 4.5)
- T1059.007 JavaScript
- T1078 Valid Accounts
- T1114.002 Remote Email Collection
- T1114.003 Email Forwarding Rule
- T1204.002 Malicious File
- T1539 Steal Web Session Cookie
- T1550.004 Web Session Cookie
- T1566.001 Spearphishing Attachment
- T1583 Acquire Infrastructure
- T1583.001 Domains
- T1585.001 Social Media Accounts
- T1585.002 Email Accounts
- T1586.002 Email Accounts
- T1588.002 Tool
- T1589 Gather Victim Identity Information
- T1593 Search Open Websites/Domains
- T1598.002 Spearphishing Attachment
- T1598.003 Spearphishing Link
- T1608.001 Upload Malware
- T1676 Linked Devices
- T1684.001 Impersonation
Software 1
Principal sources 45 reports
Ranked by how many of this actor's indicators each report brought in.
- 89community.emergingthreats.net/t/ruleset-update-summary-2023-08-09-v10…
- 82blog.sekoia.io/calisto-show-interests-into-entities-in…
- 82otx.alienvault.com/pulse/6390ecc150d6fda9ab97c604
- 56virustotal.com/gui/ip-address/20.36.28.23/relations
- 51virustotal.com/gui/ip-address/147.45.124.240/relations
- 41cloud.google.com/blog/topics/threat-intelligence/new-mal…
- 41virustotal.com/gui/file/d7520e4f1c55ed1dcbdeba5c6e681e…
- 41virustotal.com/gui/file/52eb2b3df1e5e2a07ba4562b79eeb6…
Related groups 3
What the sources have in common — not a claim that these are the same actor. See the whole graph.
Timeline 475 indicators
Each entry is a batch of indicators that appeared upstream on one date, under the report it was filed with.
Showing the 300 most recent of 475. Complete: G1033.json.
No indicator matches. Only the most recent 300 are on this page — the rest are in the JSON.
-
x.com/JCyberSec_/status/2037789860455420316 · urlscan.io/result/019d28bf-2dff-7003-adcb-4762f044…
sdij.org siidj.xyz vod.sdij.org -
x.com/JCyberSec_/status/2037789874137297214
lmhtvn.github.io mxhvn.github.io -
cloud.google.com/blog/topics/threat-intelligence/new-mal… · virustotal.com/gui/file/d7520e4f1c55ed1dcbdeba5c6e681e… · virustotal.com/gui/file/52eb2b3df1e5e2a07ba4562b79eeb6… · virustotal.com/gui/file/bce2a7165ceead4e3601e311c72743… · virustotal.com/gui/file/731ca51ac983f24f10409ae67eae65…
account.officesecure.online advath.officesecure.online auth.officesecure.online authpoint.usa.officesecure.online betmgm-support.com betus-us.info documentsec.online dotfoods.officesecure.online fogelmtab.online iceageblokegra.org id.officesecure.online inspectguarantee.org login.officesecure.online mail.officesecure.online msfed.officesecure.online mybookie-us.live ned-granting-opportunities.com ned-granting-opportunitis.org o.officesecure.online office.officesecure.online officesecure.online onlineviewerdocument.com onlwshop.eu outlook.officesecure.online oxwoocat.org pro-mybookie.com react.officesecure.online sci.officesecure.online secure.officesecure.online smusxath.officesecure.online sp.authpoint.usa.officesecure.online sso.officesecure.online stayhome-services.fr swarmsdopwis.org system-healthadv.com ulgroup.officesecure.online usa.officesecure.online vn3hg.officesecure.online webmail.officesecure.online ww12.officesecure.online ywnjb.officesecure.online -
zscaler.com/blogs/security-research/coldriver-updat…
applicationformsubmit.me blintepeeste.org captchanom.top documentsec.com hazerscotomacarted.org mediasrangylavi.org onstorageline.com preentootmist.org southprovesolutions.com viewerdoconline.com -
cloud.google.com/blog/topics/threat-intelligence/coldriv… · virustotal.com/gui/ip-address/165.227.148.68/relations · virustotal.com/gui/file/4c7accba35edd646584bb5a40ab78f… · virustotal.com/gui/file/6b85d707c23d68f9518e757cc97adb… · virustotal.com/gui/file/db0c45bb0861ae458d90c09a1e7108…
domain cloudmediaportal.com domain njala.dev url http://165.227.148.68 -
x.com/knight0x07/status/1921085672661651817
mobilizationcenter.com.ua -
x.com/StrikeReadyLabs/status/1839049108071526… · strikeready.com/blog/finding-the-unknown-unknowns-part-2 · app.validin.com/detail?find=82.221.139.160&type=ip4&ref…
accounts-ukr.com accsua.com accsukr.com alightcruellane.net data-ukr.com kinoafisha.ua.ukrrr.com localukre.com mail-ukr-net.systems manageukr.net qr-logukr.com scallopsflippant.com seukr.net support-ukr.com ukr-edit.com ukr-hub.com ukr-mail.com ukr-net.systems ukr-passc.net ukr-site.com ukraine-story.com ukrlocalsystems.net ukrmailpost.net ukrrbox.com ukrrr.com uukkrr.net verifukr.com xe-ukr.net xfiles-uk.net xh-ukr.net -
virustotal.com/gui/ip-address/20.36.28.23/relations
ankaramuhaseben.com bigdatabroadway.com cityessentials.net cloudinfodata.com cloudithub.com datawebhub.com desgnspiration.net e-fluxxsolutions.com editablezoom.org eichenfass.org entheogenicmd.com extractordraw.com galetscryptodata.com getfigmacreator.com gothicshop.org guardittech.com helmetkup.com imgrich.com inrealconnect.com instantpointzero.com intelligentautomationalley.com investfix.org justapple.net keeperdocumentllc.com keeperitlabel.com liquidacionesjudiciales.com loyaltyfirst.org mayquarkesthetic.com mettezera.com mtgcgroup.org murodjonovs.com mutualrescuebook.org mygeiger.org ommahat.net osomtoys.com owaorganizespace.com particlesolid.org postrequestin.com preview-document.tech proffsolution.com protectionoffice.tech pureafro.com quantumnyx.org riseupbit.com setupprofi.com sgmods.net skeletcheck.com skyinformdata.com storageinformationsolutions.com tarifjane.com translatesplit.com voltcloudpine.com webfigmadesignershop.com webitresourse.com xacshop.com yamaru.org -
x.com/StrikeReadyLabs/status/1839049108071526… · strikeready.com/blog/finding-the-unknown-unknowns-part-2 · app.validin.com/detail?find=82.221.139.160&type=ip4&ref…
ukr-setting.com -
x.com/StrikeReadyLabs/status/1825638114955510…
domain ukrnetset.com url http://82.221.130.78 -
citizenlab.ca/2024/08/sophisticated-phishing-targets-…
egenre.net eilatocare.com esestacey.net ideaspire.net ithostprotocol.com matalangit.org togochecklist.com vocabpaper.com xsltweemat.org -
virustotal.com/gui/ip-address/147.45.124.240/relations
app-sharcpointe.com client-serviceauth0.com cloud-sharcpoint.com cloud-sharcpolnte.com doc-sharcpoint.com doc-sharcpointe.com docs-sharcpointe.com docs-sharcpolnt.com secureclientauth0.com sharcpointeapp.com sharcpointedocs.com sharepointeapp.com sharepolnte-app.com system-sharcpoint.com system-sharcpointe.com -
virustotal.com/gui/ip-address/147.45.124.240/relations
app-sharcpoint.com app-sharcpolnt.com app-sharcpolnte.com appsharcpointe.com appsharcpointes.com appssharcpointe.com cloud-sharcpointe.com cloud-sharepolnt.com cloudsharepolnte.com doc-sharepointe.com docs-sharcpoint.com docs-sharcpolnte.com docs-sharepolnt.com secureauth-login.com serviceauth0.com sharcpoint-app.com sharcpoint-docs.com sharcpoint-web.com sharcpointapp.com sharcpointe-cloud.com sharcpointe-doc.com sharcpointecloud.com sharcpointedoc.com sharcpointedocsapp.com sharcpointedocuments.com sharcpolnte-docs.com sharcpolnte-web.com sharepointbeagle.com sharepointdesign.com sharepointe-cloud.com sharepointe-docs.com sharepolnte-docs.com sharepolnte-web.com web-sharcpoint.com web-sharcpolnt.com web-sharepolnt.com -
x.com/alex_lanstein/status/1816306001781367143 · blog.strikeready.com/blog/russia-nexus-actor-targets-ukraine · cert.gov.ua/article/6280183 (# UAC-0102) · virustotal.com/gui/ip-address/82.221.139.200/relations · virustotal.com/gui/file/e159886a173f021b345ad152ad84be… · virustotal.com/gui/file/853f21ba9a8a362a9bafc98204eb70… · virustotal.com/gui/file/2f1f4b077b6fc40d8f0c995e806574… · virustotal.com/gui/file/38963b61113b7b88e3fce30539e63b… · virustotal.com/gui/file/9e49db0eb920e130c0393a87c96434…
domain accounts.kv-ukr.net domain accounts.ukr-mails.net domain accounts.ukr-reset.email domain changepassword-ukr.net domain kv-ukr.net domain uaccsnet.com domain ualogaccs.com domain uasettings.com domain uasetukr.com domain uasystdoc.com domain uasystnet.com domain ukainua.com domain ukenlog.com domain uknetlogin.com domain ukr-mails.net domain ukr-reset.email domain ukrsets.com domain ukrsett.com domain ukrstnet.com domain unetset.com url http://82.221.139.200 -
medium.com/@fofabot/practical-fofa-asset-discovery…
89.19.211.240:3000 95.164.17.94:3000 -
blog.google/threat-analysis-group/google-tag-coldri… · virustotal.com/gui/file/37c52481711631a5c73a6341bd8bea…
45.133.216.15:3000 -
community.emergingthreats.net/t/ruleset-update-summary-2023-08-09-v10…
bittechllc.net centeritdefcity.com checkscreenit.com cloudcpanelhost.com clouddefsystems.com cloudrootstorage.com commandentrance.com computertechdirectsystems.com computingtechstudio.com configuregatewayglobal.com controlgatestorage.com controlsstoragedirect.com controlstoragesolutions.com cryptdatagate.com cryptotechdirect.com cryptothistech.com datagatellc.com datagatewayglobal.com datastoragecrypto.com definform.com deskactivitygm.com directdocumentgate.com directdocumentgateway.com directexpressgateway.com directstoragegate.com docsinfogate.com documentdirectllc.com documentdirectto.com entrywaycenter.com gateblurbrepository.com gatecryptospace.com gateinfosecure.com gatestoragetech.com gatewaydocsint.com gatewayitsol.com gatewayrecord.com gawecryptoinfosolutions.com getinfostarter.com incappcloud.com infocryptogate.com infogatestorage.com informationcoindata.com informationswitchsystems.com infostorageroute.com intelligencerepository.com itgatestorage.com itinfogate.com keepitlabgroup.com managercodepro.com meshgoin.com myitappnext.com myittechnext.com networkgoin.com oneinformationcrypto.com pdfdirectglobal.com pdfsecxcloudroute.com po.vatangate.com prodefendme.com prokeeperit.com protectedviews.com protectordocumentcenter.com realeasyconfiguregateway.com realitsolutionprimary.com safetydocsgateway.com secureglobaltele.com serverguarditweb.com shielditlabel.com shortinfoonline.com · 21 more in this batch, in the JSON
Further reading 50
- attack.mitre.org/groups/G1033
- blog.google/threat-analysis-group/google-tag-coldri…
- cisa.gov/news-events/cybersecurity-advisories/aa…
- microsoft.com/en-us/security/blog/2022/08/15/disrupti…
- microsoft.com/en-us/security/blog/2023/12/07/star-bli…
- x.com/JCyberSec_/status/2037789874137297214
- blog.sekoia.io/calisto-show-interests-into-entities-in…
- virustotal.com/gui/file/52eb2b3df1e5e2a07ba4562b79eeb6…
- medium.com/@fofabot/practical-fofa-asset-discovery…
- virustotal.com/gui/file/9e49db0eb920e130c0393a87c96434…
- virustotal.com/gui/file/731ca51ac983f24f10409ae67eae65…
- zscaler.com/blogs/security-research/coldriver-updat…
- x.com/knight0x07/status/1921085672661651817
- virustotal.com/gui/file/d7520e4f1c55ed1dcbdeba5c6e681e…
- otx.alienvault.com/pulse/6390ecc150d6fda9ab97c604
- twitter.com/r0ny_123/status/1549751626004500481
- blog.strikeready.com/blog/russia-nexus-actor-targets-ukraine
- virustotal.com/gui/file/6b85d707c23d68f9518e757cc97adb…
- otx.alienvault.com/pulse/6272996039678903e0b73dd5
- urlscan.io/result/019d28bf-2dff-7003-adcb-4762f044…
- app.validin.com/detail?find=82.221.139.160&type=ip4&ref…
- strikeready.com/blog/finding-the-unknown-unknowns-part-2
- x.com/alex_lanstein/status/1816306001781367143
- blog.google/threat-analysis-group/tracking-cyber-ac…
- virustotal.com/gui/file/e159886a173f021b345ad152ad84be…
- cloud.google.com/blog/topics/threat-intelligence/coldriv…
- x.com/JCyberSec_/status/2037789860455420316
- x.com/StrikeReadyLabs/status/1825638114955510…
- virustotal.com/gui/ip-address/20.36.28.23/relations
- virustotal.com/gui/ip-address/82.221.139.200/relations
- virustotal.com/gui/file/7b95747eeea196c1485d089fa47a06…
- x.com/StrikeReadyLabs/status/1839049108071526…
- virustotal.com/gui/file/db0c45bb0861ae458d90c09a1e7108…
- virustotal.com/gui/file/bce2a7165ceead4e3601e311c72743…
- virustotal.com/gui/file/4c7accba35edd646584bb5a40ab78f…
- community.emergingthreats.net/t/ruleset-update-summary-2023-08-09-v10…
- virustotal.com/gui/file/38963b61113b7b88e3fce30539e63b…
- virustotal.com/gui/file/2f1f4b077b6fc40d8f0c995e806574…
- cloud.google.com/blog/topics/threat-intelligence/new-mal…
- microsoft.com/security/blog/2022/08/15/disrupting-sea…
10 more, and the report behind every indicator, in G1033.json.