FSB

Russia's Federal Security Service is the country's chief agency for domestic security and counter-intelligence, set up in 1995 from the domestic directorates of the Soviet KGB. It also runs offensive cyber units that operate against foreign targets, and Western governments now attribute at least two of those units by number.

Britain holds Centre 18 responsible for Star Blizzard, a group that has pursued British parliamentarians, civil servants and journalists since at least 2015; London sanctioned two named operators in December 2023. US and allied agencies tie the Snake implant and much of the Turla toolset to a unit inside Centre 16. In March 2026 the UK NCSC and the Dutch AIVD listed Star Blizzard among the state actors taking over Signal and WhatsApp accounts with malicious QR codes.

The FSB's cyber operations in 2026 concentrate on the people WHO shape Western backing for Ukraine. Microsoft's September findings, which rest on CISA's placement of Star Blizzard under Centre 18, describe fake event invitations in the names of Chatham House, the IISS and the Atlantic Council, sent to think tanks, NGOs, diplomats and Ukrainian civil society groups. Microsoft found that the first message carried nothing malicious; the CosmicPulse backdoor followed only after the target wrote back.