# UK allies attribute Russian FSB Star Blizzard political interference campaign

Published: 2023-12-07 · Severity: routine · Sectors: government-national, media, education, non-profit
Canonical: https://vorant.io/reports/d3487b9a-c847-5010-b154-9a0ca4d46660/uk-allies-attribute-russian-fsb-star-blizzard-political-interference-campaign

> Russian FSB Centre 18 group Star Blizzard conducted sustained spear-phishing and document-theft operations targeting UK politicians, media, and civil society since at least 2015.

The UK's National Cyber Security Centre (NCSC) and international partners from the US, Australia, Canada, and New Zealand have formally attributed a multi-year cyber campaign to Star Blizzard, assessed as almost certainly subordinate to Centre 18 of Russia's Federal Security Service. The group has targeted high-profile individuals including UK parliamentarians across multiple parties, journalists, universities, NGOs, and civil society organisations since at least 2015. The campaign included spear-phishing attacks, compromise of UK-US trade documents leaked ahead of the 2019 General Election, and breaches of the Institute for Statecraft and its founder Christopher Donnelly, with stolen documents subsequently leaked to amplify Russian disinformation goals.

The NCSC and partner agencies have published a joint technical advisory detailing the actors' methods and defensive measures. The group employs selective leaking of compromised information coordinated with Russian strategic messaging to undermine trust in UK and allied democracies. Defenders are advised to implement two-factor authentication, use strong passwords, and install security updates promptly. The activity represents part of a broader pattern of Russian Intelligence Services cyber operations globally, including previous campaigns targeting ViaSat, SolarWinds, and critical infrastructure.

## Mentioned in this report

- Threat actors: Star Blizzard

Source reporting: https://www.ncsc.gov.uk/news/uk-and-allies-expose-cyber-campaign-attempted-political-interference

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/d3487b9a-c847-5010-b154-9a0ca4d46660/uk-allies-attribute-russian-fsb-star-blizzard-political-interference-campaign.
In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), live profiles of the actors and CVEs it names, and the vendor research on the same campaign. Slack alerts fire on the vendors, sectors and countries a reader follows. A new account starts with three days of all of it, no card: https://vorant.io/signup