Friday, July 19, 2024

Russian Star Blizzard New Evasion Techniques to Hijack Email Accounts

Hackers target email accounts because they contain valuable personal and financial information. Successful email breaches enable threat actors to:-

Cybersecurity researchers at Microsoft Threat Intelligence team recently unveiled that the Russian state-sponsored actor, Star Blizzard (aka SEABORGIUM, COLDRIVER, Callisto Group), has increased its sophistication and developed new evasion techniques to utilize in ongoing attacks.

Star Blizzard enhanced evasion techniques since 2022, focusing on email credential theft, and they target the following entities aligning with Russian interests:-

  • International affairs
  • Defense
  • Logistics for Ukraine
  • Academia

Microsoft improves defenses against spear-phishing and is grateful for the collaboration with the following global cybersecurity partners:- 

  • FBI

New TTPs

Here below, we have mentioned all the new TTPs identified by the cybersecurity analysts at the Microsoft Threat Intelligence team:-

  • Use of server-side scripts to prevent automated scanning
  • Use of email marketing platform services
  • Use of a DNS provider to resolve actor-controlled domain infrastructure
  • Password-protected PDF lures or links to cloud-based file-sharing platforms
  • Randomizing DGA for actor-registered domains

Russian Star Blizzard Attack Chain

Star Blizzard focuses on email credential theft, favoring cloud-based providers. They persist with the Evilginx framework, relying on spear-phishing via email and custom PDF lures. 

Redirection to actor-controlled infrastructure involves dedicated VPS pairs and, for target email providers, consistent use of Evilginx with “phishlet.”

Star Blizzard redirection chain (Source – Microsoft)

Connected users and organizations in these areas are potential Star Blizzard targets:-

  • Government or diplomacy
  • Research into defense policy or international relations when related to Russia.
  • Assistance to Ukraine related to the ongoing conflict with Russia.

Emails mimic known contacts via Proton email accounts (,, and the initial message requests a document review, but it does not provide any attachment or link to the document. 

After the response, a follow-up includes a PDF file or link to a cloud-hosted PDF that will be unreadable with a misleading content-enable button.

Star Blizzard PDF lures (Source – Microsoft)

Pressing the PDF button opens a link, starting a redirection chain. The “Docs” page appears, followed by a CAPTCHA, and then the Sign-in screen displays the targeted email in the username field. 

The host domain is actor-controlled, not the expected server domain. Password entry triggers an authentication request.

If approved, the account is compromised, and then the threat actor gains full access with successfully compromised credentials.


Here below, we have mentioned all the recommendations provided by the cybersecurity researchers:-

  • Make sure to use advanced anti-phishing solutions.
  • Always run EDR in block mode.
  • In full automated mode, always configure investigation and remediation.
  • On Microsoft Defender Antivirus, make sure to turn on cloud-delivered protection and automatic sample submission.
  • As a baseline set of policies, always use security defaults.
  • Continuous access evaluation is a must.
  • All suspicious or anomalous activities must be monitored continuously.
  • To recheck links on click, ensure proper configuration of Microsoft Defender for Office 365.
  • In Microsoft Defender for Office 365, make sure to use the Attack Simulator.
  • Always encourage users to use web browsers that support Microsoft Defender SmartScreen.
  • Block executable files from running unless.
  • Block execution of potentially obfuscated scripts.

Latest articles

Hackers Claiming Dettol Data Breach: 453,646 users Impacted

A significant data breach has been reported by a threat actor known as 'Hana,'...

CrowdStrike Update Triggers Widespread Windows BSOD Crashes

A recent update from cybersecurity firm CrowdStrike has caused significant disruptions for Windows users,...

Operation Spincaster Disrupts Approval Phishing Technique that Drains Victim’s Wallets

Chainalysis has launched Operation Spincaster, an initiative to disrupt approval phishing scams that have...

Octo Tempest Know for Attacking VMWare ESXi Servers Added RansomHub & Qilin to Its Arsenal

Threat actors often attack VMware ESXi servers since they accommodate many virtual machines, which...

TAG-100 Actors Using Open-Source Tools To Attack Gov & Private Orgs

Hackers exploit open-source tools to execute attacks because they are readily available, well-documented, and...

macOS Users Beware Of Weaponized Meeting App From North Korean Hackers

Meeting apps are often targeted and turned into weapons by hackers as they are...

Hackers Exploiting Legitimate RMM Tools With BugSleep Malware

Since October 2023, MuddyWater, which is an Iranian threat group linked to MOIS, has...
Guru baran
Guru baran
Gurubaran is a co-founder of Cyber Security News and GBHackers On Security. He has 10+ years of experience as a Security Consultant, Editor, and Analyst in cybersecurity, technology, and communications.

Free Webinar

Low Rate DDoS Attack

9 of 10 sites on the AppTrana network have faced a DDoS attack in the last 30 days.
Some DDoS attacks could readily be blocked by rate-limiting, IP reputation checks and other basic mitigation methods.
More than 50% of the DDoS attacks are employing botnets to send slow DDoS attacks where millions of IPs are being employed to send one or two requests per minute..
Key takeaways include:

  • The mechanics of a low-DDoS attack
  • Fundamentals of behavioural AI and rate-limiting
  • Surgical mitigation actions to minimize false positives
  • Role of managed services in DDoS monitoring

Related Articles