APT ATLAS

⌘K

Atlas Actors145 Names507 Sectors40

Star Blizzard (aka BlueCharlie, SEABORGIUM) · APT Atlas

Actors/Nation-state / APT/Europe

Star Blizzard

G1033APTRU · Russia

AKA BlueCharlie · SEABORGIUM · TAG-53 · Callisto · COLDRIVER · UNC4057 · Calisto

CrowdStrike: GOSSAMER BEARMITRE: G1033Proofpoint: TA446PwC: Blue CallistoSecureworks: IRON FRONTIER

FSB cyber-espionage group targeting Western think tanks, NGOs, and politicians.

Targets5

Sectors6

Threat types1

GIRs mapped0/480

Active since2017

Explore in atlas

Export

STIX 2.1 ATT&CK Navigator

QUICK FACTS

TypeNation-state / APT

OriginRussia

First seen2017

Type (verbatim)nation-state APT

GIR mappings0/480

TTPs9

Targets5

Sectors6

Record updated2026-08-03

Also tracked as

6 vendor names · 7 other aliases

Open Rosetta Stone

CrowdStrike

GOSSAMER BEAR

Microsoft

Star Blizzard

MITRE

G1033

Proofpoint

TA446

PwC

Blue Callisto

Secureworks

IRON FRONTIER

UNATTRIBUTED ALIASESBlueCharlieSEABORGIUMTAG-53CallistoCOLDRIVERUNC4057Calisto

Victimology

Geographic footprint · 5 countries

Export STIX

origin · Russiatargeted countries · 5

EUROPE · 4

United Kingdom · Poland · Russia · Ukraine

AMERICAS · 1

United States

Sectors targeted

6 of 40

Government100 actors Defense72 actors NGOs & Dissidents56 actors Education & Research62 actors Media & Journalism48 actors Logistics21 actors

Tactics, techniques, procedures

Threat types + MITRE ATT&CK mapping

THREAT TYPES

ESP · Espionage

MITRE ATT&CK · 9 techniques

Reconnaissance · 1

T1593Search Open Websites/Domains

Resource Development · 1

T1583Acquire Infrastructure

Initial Access · 1

T1566.001Spearphishing Attachment

Execution · 1

T1059.007JavaScript

Lateral Movement · 1

T1550.004Web Session Cookie

Collection · 2

T1114.002Remote Email Collection T1114.003

Stealth · 2

T1078Valid Accounts

GIR mappings

0 / 480 requirements mapped

Open matrix

No GIRs mapped yet for this actor.

References

No supporting references have been recorded for this profile. Treat uncited claims as unverified.

Open data

Machine-readable exports of this profile

JSON · RESTActor recordFull profile via the public v1 API STIX 2.1Intrusion-set bundleDeterministic ids · techniques + targeted countries ATT&CK NAVIGATORTechnique layer9 techniques · layer format 4.5

Related actors

By origin and actor type

Agriusnation-state

Iran · 2 targets · since 2020

AppleJeusnation-state

North Korea · 25 targets · since 2018

APT1nation-state

China · 17 targets · since 2006

APT10nation-state

China · 19 targets · since 2009

APT12nation-state

China · 11 targets · since 2009

APT14nation-state

China · 15 targets · since —

Email Forwarding Rule

T1684.001

Impersonation