Pierluigi Paganini
January 17, 2025
In November 2024, Microsoft researchers observed the Russia-linked APT group Star Blizzard targeting WhatsApp accounts via spear-phishing, shifting tactics to avoid detection.
The Star Blizzard group, aka “Callisto“, “Seaborgium“, “ColdRiver”, and “TA446,” targeted government officials, military personnel, journalists and think tanks since at least 2015.
The group’s past activity involved persistent phishing and credential theft campaigns leading to intrusions and data theft. The APT primarily targets NATO countries, but experts also observed campaigns targeting the Baltics, Nordics, and Eastern Europe regions, including Ukraine.
Star Blizzard’s spear-phishing campaign targets WhatsApp users, leveraging familiar tactics. Threat actors initially send an email to their targets, to engage them, then send them a second email containing a malicious link.
Attackers impersonate a US government official, and the initial email sent to targets contains a QR code purporting to direct users to join a WhatsApp group on “the latest non-governmental initiatives aimed at supporting Ukraine NGOs.” The intentionally broken code aims to prompt the recipient to respond to the phishing attempt.
Star Blizzard’s second email contains a malicious link redirecting to a webpage with a QR code. Scanning it grants the attacker access to the victim’s WhatsApp account.
“When the recipient responds, Star Blizzard sends a second email containing a Safe Links-wrapped t[.]ly shortened link as the alternative link to join the WhatsApp group.” reads the report published by Microsoft.
“When this link is followed, the target is redirected to a webpage asking them to scan a QR code to join the group. However, this QR code is actually used by WhatsApp to connect an account to a linked device and/or the WhatsApp Web portal. This means that if the target follows the instructions on this page, the threat actor can gain access to the messages in their WhatsApp account and have the capability to exfiltrate this data using existing browser plugins, which are designed for exporting WhatsApp messages from an account accessed via WhatsApp Web.”
Though the campaign ended in November, it showed Star Blizzard’s shift in tactics and persistence in spear-phishing for sensitive data access.
Microsoft advises vigilance for email users in sectors commonly targeted by Star Blizzard, especially when handling emails with external links.
Microsoft provided Indicators of compromise (IoCs) for this campaign along with mitigations.
Follow me on Twitter: @securityaffairs and Facebook and Mastodon
(SecurityAffairs – hacking, Russia)
