In a recent development, the Russian-affiliated threat actor known as Star Blizzard has initiated a spear-phishing campaign targeting WhatsApp accounts, marking a significant shift from their traditional methods.

The emergence of Star Blizzard's new tactics underscores the evolving nature of cyber threats. By targeting WhatsApp accounts through sophisticated spear-phishing campaigns, they aim to exploit personal communication channels, posing significant risks to individuals and organizations alike.

Active since at least 2012, Star Blizzard - also known by aliases such as SEABORGIUM, Blue Callisto, and BlueCharlie - has predominantly focused on credential harvesting through spear-phishing emails. Their typical approach involved sending emails from ProtonMail accounts with malicious attachments or links leading to adversary-in-the-middle (AiTM) phishing pages designed to capture login credentials and two-factor authentication codes.

However, recent intelligence from Microsoft's Threat Intelligence team reveals a tactical evolution. Between January and November 2024, Star Blizzard targeted individuals in government, diplomacy, defence policy, and international relations sectors, especially those connected to Ukraine.

The threat actor dispatched spear-phishing emails masquerading as communications from U.S. government officials. These emails contained Quick Response (QR) codes, prompting recipients to join WhatsApp groups focused on supporting Ukrainian NGOs.

Notably, the embedded QR codes were intentionally non-functional, compelling recipients to engage directly with the threat actors.

Upon receiving a response, the threat actors sent a follow-up message with a shortened link leading to a webpage hosting a QR code. By scanning the code, victims inadvertently granted the threat actor access to their WhatsApp communications, enabling unauthorised data exfiltration.

This strategic pivot by Star Blizzard highlights their adaptability in response to public exposure and counter measures.

Reporting

Report all Fraud and Cybercrime to Action Fraud by calling 0300 123 2040 or online. Forward suspicious emails to report@phishing.gov.uk. Report SMS scams by forwarding the original message to 7726 (spells SPAM on the keypad).