Microsoft, DOJ Dismantle Russian Hacker Group Star Blizzard

Microsoft and the US Department of Justice joined forces this week to take down more than 100 domains linked to a Russian-sponsored hacker group known as Star Blizzard.

The advanced persistent threat (APT), active since 2017, has targeted journalists, non-governmental organizations (NGOs), and Russia experts, particularly those supporting Ukraine.

The operation, which dismantled the group’s server infrastructure in the West, is expected to delay the cyberattackers’ ability to regroup and operate.

“Today’s seizure of 41 internet domains reflects the Justice Department’s cyber strategy in action — using all tools to disrupt and deter malicious, state-sponsored cyber actors,” Deputy Attorney General Lisa Monaco said in a statement issued by the DoJ.

Star Blizzard, also referred to as “Cold River” and “Callisto,” uses primarily phishing emails to steal login credentials from its targets, and had recently developed its first custom backdoor.

In a partially unsealed indictment, the DoJ also revealed that two FSB officers, Ruslan Peretyatko and Andrey Korinets, were charged last December for their involvement in Star Blizzard espionage campaigns, which have extended to the UK, NATO countries, and Ukraine. The government’s affidavit reveals that in the US, the group targeted military contractors, intelligence community personnel, and government agencies, among others.

The Kremlin-sponsored APT is known for its sophisticated evasion techniques, although Microsoft has been following it, and disrupted the group’s activities in 2022 and again last year.

“Rebuilding infrastructure takes time, absorbs resources, and costs money,” Microsoft noted in a blog post on the most recent takedown. “Today’s action is an example of the impact we can have against cybercrime when we work together.”

A Step in Protection as US Election Nears

The disruption comes at a crucial time, as US officials are on high alert for foreign interference ahead of the upcoming presidential election. With Star Blizzard’s status as a tool for advancing Russian interests, including election disruption, Microsoft emphasized that the takedown action directly impacts efforts to protect the US democratic process from external threats.

“Between January 2023 and August 2024, Microsoft observed Star Blizzard target over 30 civil society organizations — journalists, think tanks, and non-governmental organizations (NGOs) core to ensuring democracy can thrive — by deploying spear-phishing campaigns to exfiltrate sensitive information and interfere in their activities. While we expect Star Blizzard to always be establishing new infrastructure, today’s action impacts their operations at a critical point in time when foreign interference in US democratic processes is of utmost concern.”

Russian Threat Likely to Persist

Sean McNee, head of threat research at DomainTools, says he anticipates a dramatic increase in nation-state backed groups turning toward purchasing domains to carry out cyberespionage, and to seed misinformation and disinformation around the US election as well — so the combined DoJ/Microsoft action might just be a drop in the ocean.

“[The Star Blizzard takedown is a] huge step in protecting the Internet,” he says, but adds it is likely only “scratching the surface” when it comes to FSB or other groups who have purchased domains to seed malignant websites.

“We have found that some domain hosting services sell domain registrations indiscriminately and are not always responsive when notified about malicious content or coordinated misinformation,” he explains.

Tom Kellermann, senior vice president of cyber strategy at Contrast Security, warns Russia has “ratcheted up the cyber insurgency” in American cyberspace.

“Russia is cognizant that the soft underbelly of the US is our dependence on technology,” he says, pointing out that the Star Blizzard revelations show that “the GRU and a few cybercrime cartels are collaborating in widespread campaigns of infiltration.”

He says he is concerned that the resultant backdoors will be used to deploy destructive malware in the coming days, adding threat hunting must be expanded and runtime security must be activated to blunt the Russian campaign.

“Something wicked this way comes,” Kellerman says. “The private sector must take this warning seriously.”