TL;DR
- Star Blizzard: Evolved Tactics and Evasion Techniques in Ongoing Cyber Attacks
- Global Governments Employ Push Notification Spying on Apple and Google Users
- Critical Bluetooth Vulnerability Allows Takeover of Multiple Operating Systems
- Bypassing EDRs with 'Pool Party' Process Injection Techniques
- Widespread LogoFail Vulnerability Threatens Majority of Windows and Linux Devices
Star Blizzard: Evolved Tactics and Evasion Techniques in Ongoing Cyber Attacks
- Persistent Threat from Russian State-Sponsored Actor: Star Blizzard, formerly known as SEABORGIUM and also referred to as COLDRIVER and Callisto Group, is a Russian state-sponsored actor that Microsoft Threat Intelligence has been actively tracking. Their operations, believed to be aligned with both espionage and cyber influence objectives, primarily target international affairs, defense, academia, and entities involved in logistics support to Ukraine. Microsoft, in collaboration with international cybersecurity entities like the UK National Cyber Security Centre and the US National Security Agency, continues to refine defenses against Star Blizzard's evolving spear-phishing tactics.
- Evolving Evasive Techniques: In recent developments, Star Blizzard has enhanced its detection evasion capabilities, employing five new techniques. These include utilizing server-side scripts to evade automated scanning, leveraging email marketing services to mask email sender addresses, using a DNS provider to obscure IP addresses, deploying password-protected PDF lures or links to cloud-based file-sharing platforms, and employing a more randomized domain generation algorithm (DGA) for actor-registered domains.
- Operational Focus and Tactics: Star Blizzard remains focused on email credential theft, primarily targeting cloud-based email providers. They use the Evilginx framework for spear-phishing, directing targets to Evilginx server infrastructure configured for credential theft. Their tactics include the use of custom-built PDF lures to initiate browser sessions that follow a redirection chain ending at their controlled infrastructure.
- CISA and International Advisory: The Cybersecurity and Infrastructure Security Agency (CISA), alongside international partners, has issued a joint advisory against Star Blizzard. The group has been noted for targeting specific sectors in the US and UK, as well as other NATO countries, with activities expanding to include defense-industrial targets and US Department of Energy facilities. Star Blizzard predominantly sends spear-phishing emails to personal email addresses to circumvent corporate network security controls, using open-source tools for credential harvesting.
