FSB Centre 18
Russia's FSB Centre for Information Security, which UK and US agencies tie to Star Blizzard.
Microsoft tied at least 13 phishing campaigns run between January and August 2026 to Star Blizzard, the group Five Eyes agencies judge almost certainly subordinate to FSB Centre 18, using fake think-tank event invitations.
Last refreshed: 12 October 2026
Which FSB unit runs the phishing aimed at British MPs?
Timeline for FSB Centre 18
Named as Centre 18
Cybersecurity: Threats and Defences: Mentioned in: Star Blizzard lures think tanks by inviteBackground
Centre 18 is the Federal Security Service's Centre for Information Security, known by its Russian initials TsIB and as Military Unit 64829. A UK Government factsheet updated on 7 December 2023 places it inside the FSB 1st Service, the counter-intelligence Arm. It is a separate unit from Centre 16, which 19 agencies named over router hijacking in July 2026.
On that December day Britain and its Five Eyes partners issued advisory AA23-341A, assessing that Star Blizzard is "almost certainly subordinate" to Centre 18. Since 2019 the group has gone after academics, defence bodies, government departments, NGOs, think tanks and politicians, mostly in Britain and the US. London's factsheet ties the unit to spear-phishing of MPs from 2015 to 2023 and to the leak of UK-US trade documents ahead of the 2019 general election. Britain sanctioned two group members that month and said the attempts to interfere in UK politics had not succeeded.
Centre 18's operators were still active in 2026. On 29 September Microsoft attributed at least 13 campaigns from January to August to Star Blizzard, with lures styled as invitations from think tanks such as Chatham House.
