UK allies attribute Russian FSB Star Blizzard political interference campaign
Free public brief. The indicators, the detections with Splunk SPL already written (plus Elastic and KQL where they apply), and a Slack alert the next time this touches a vendor you run are in the app — free account, no card.
Russian FSB Centre 18 group Star Blizzard conducted sustained spear-phishing and document-theft operations targeting UK politicians, media, and civil society since at least 2015.
The UK's National Cyber Security Centre (NCSC) and international partners from the US, Australia, Canada, and New Zealand have formally attributed a multi-year cyber campaign to Star Blizzard, assessed as almost certainly subordinate to Centre 18 of Russia's Federal Security Service. The group has targeted high-profile individuals including UK parliamentarians across multiple parties, journalists, universities, NGOs, and civil society organisations since at least 2015. The campaign included spear-phishing attacks, compromise of UK-US trade documents leaked ahead of the 2019 General Election, and breaches of the Institute for Statecraft and its founder Christopher Donnelly, with stolen documents subsequently leaked to amplify Russian disinformation goals.
The NCSC and partner agencies have published a joint technical advisory detailing the actors' methods and defensive measures. The group employs selective leaking of compromised information coordinated with Russian strategic messaging to undermine trust in UK and allied democracies. Defenders are advised to implement two-factor authentication, use strong passwords, and install security updates promptly. The activity represents part of a broader pattern of Russian Intelligence Services cyber operations globally, including previous campaigns targeting ViaSat, SolarWinds, and critical infrastructure.
Mentioned in this report
Source reporting: https://www.ncsc.gov.uk/news/uk-and-allies-expose-cyber-campaign-attempted-political-interference
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), the actors and CVEs it names as live profiles, and the vendor research on the same campaign — the primary source the news paraphrased, cited and read directly.
It sits in a corpus of 13,854 reports from 146 sources, 614 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Name the vendors you run and Slack hears about the reports that touch them — about forty a week that are yours, not the four hundred that are not.
Create a free account What it costs