COLDRIVER

Summary

FSB Centre 18 credential phishing against Western think tanks, academics, and politicians. Masquerades as journalists. US/UK disrupted operations and sanctioned operator Andrey Korinets (Dec 2023).

Attribution

Named by a government: indictment, sanctions designation, joint advisory or official statement.

• UK NCSC (Government, 2023-12-07)
  Star Blizzard is almost certainly subordinate to FSB Centre 18
• MITRE ATT&CK (MITRE ATT&CK, 2026-10)
  Originates in Russia; campaigns align with Russian state interests

Campaigns 3

Newest first. ASSESSED: tied to the actor with hedging or through an alias. CLAIMED: an allegation no independent source confirms.

MITRE ATT&CK techniques 6

Malware and tools 5

Infrastructure patterns

• Phishing sent from accounts on compromised cPanel and WordPress sites (Microsoft, 2026)
• Random-word or lookalike domains host its phishing; redirects to Evilginx servers (CISA, 2023; MITRE ATT&CK, 2026)
• Moves to new domains quickly once infrastructure is exposed (Microsoft, 2025; Google GTIG, 2025)
• WhatsApp linked-devices feature ties accounts to its infrastructure for exfiltration (MITRE ATT&CK, 2026)

Reporting and advisories 5

• CISA
  AA23-341A — Star Blizzard Spear-Phishing
• Microsoft Threat Intelligence
  RedFlick phishing waves delivering CosmicPulse
• Google Threat Intelligence Group
  COLDCOPY ClickFix → NOROBOT/MAYBEROBOT re-tooling
• Microsoft Threat Intelligence
  WhatsApp group QR-code account hijacking
• MITRE ATT&CK
  COLDRIVER (G1033) group profile