CISA Star Blizzard Advisory December 2023

Star Blizzard has used stolen credentials to sign into victim email accounts.

Star Blizzard has remotely accessed victims' email accounts to steal messages and attachments.

Star Blizzard has abused email forwarding rules to monitor the activities of a victim, steal information, and maintain persistent access after compromised credentials are reset.

Star Blizzard has used EvilGinx to steal the session cookies of victims directed to
phishing domains.

Star Blizzard has bypassed multi-factor authentication on victim email accounts by using session cookies stolen using EvilGinx.

Star Blizzard has registered domains using randomized words and with names resembling legitimate organizations.

Star Blizzard has established fraudulent profiles on professional networking sites to conduct reconnaissance.

Star Blizzard has registered impersonation email accounts to spoof experts in a particular field or individuals and organizations affiliated with the intended target.

Star Blizzard has used compromised email accounts to conduct spearphishing against
contacts of the original victim.

Star Blizzard has incorporated the open-source EvilGinx framework into their spearphishing activity.

Star Blizzard has identified ways to engage targets by researching potential victims' interests and social or professional contacts.

Star Blizzard has used open-source research to identify information about victims to use in targeting.

Star Blizzard has sent emails to establish rapport with targets eventually sending messages with attachments containing links to credential-stealing sites.

Star Blizzard has sent emails to establish rapport with targets eventually sending messages with links to credential-stealing sites.

Star Blizzard has registered impersonation email accounts to spoof experts in a particular field or individuals and organizations affiliated with the intended target.