Microsoft and police have eliminated Russian Star Blizzard gang

In a cooperation between US authorities and Microsoft, the Russian Callisto Group managed to get into the parade. A total of 107 websites used to implement information-gathering phishing campaigns were seized.

Espionage via phishing

Targets of criminal activity included U.S. government agencies, think tanks, and other organizations. According to the investigation, the Callisto Group, also known as Star Blizzard or Coldriver, is said to have close ties to the Russian domestic intelligence service FSB and has been targeting defense, intelligence and political organizations as well as scientific institutions since at least 2017.

According to a statement from U.S. Assistant Attorney General Lisa Monaco, the latest phishing campaign ran through fake email accounts designed to appear trustworthy to victims and trick them into revealing their credentials. US law enforcement has seized 41 domains used by the Callisto Group to break into targets’ computers and email accounts and steal valuable information and classified US intelligence information.

In addition to the domains already seized, a court order requested by Microsoft authorized the shutdown of an additional 66 domains. Between January 2023 and August 2024, Microsoft had collected reports of phishing attacks by the Callisto group on 30 civil society organizations and institutions, including journalists, think tanks and non-governmental organizations.

Mastermind wanted

The action comes at a critical time when concerns about foreign interference in the U.S. democratic processes are high. Microsoft emphasized that the seizure was a crucial step to disrupt the hacker group’s activities and quickly neutralize any future infrastructure that may be built quickly. In addition, two people, FSB officer Ruslan Aleksandrovich Peretyatko and his co-conspirator Andrey Stanislavovich Korinets, are the focus of criminal investigations.

They are accused of breaking into networks of the US, the UK, other NATO countries and Ukraine on behalf of the Russian government. As early as December 2023, several government authorities had warned about the Callisto Group’s phishing techniques.