FSB Star Blizzard

The UK Government holds FSB Centre 18, a unit of Russia's Federal Security Service, accountable for Star Blizzard. Microsoft's 29 September 2026 report tied the group to at least 13 campaigns that reached think tanks, NGOs, diplomats, academics, journalists and Ukrainian civil society. Its invitations borrowed the names of Chatham House, the IISS and the Atlantic Council; the opening email carried nothing malicious, and only a reply drew a password-protected archive that installed the CosmicPulse Python backdoor, a chain Microsoft calls RedFlick.

Star Blizzard also goes after messaging accounts. In March 2026 Britain's NCSC and the Dutch AIVD listed it with China's APT31 and Iran's IRGC among state actors using malicious QR codes to take over Signal and WhatsApp accounts of politicians, lawyers and journalists.

London says the group has targeted MPs, civil servants and journalists since at least 2015 and blames it for the 2019 leak of UK-US trade documents. In December 2023 the UK sanctioned two Star Blizzard operators, FSB intelligence officer Ruslan Peretyatko and Andrey Korinets. Security firms track the same activity as SEABORGIUM, Callisto Group, COLDRIVER, TA446, TAG-53 and BlueCharlie.