Russian criminal gang Star Blizzard found hitting WhatsApp accounts

• Microsoft observed Star Blizzard engaging in spear-phishing attack
• The group is going after WhatsApp accounts of diplomats and government workers engaged in the Ukraine-Russia war
• The phishing attack uses QR codes

A Russian state-sponsored threat actor has been spotted engaging in a unique cyber-campaign aimed at supporting the country’s war effort against Ukraine.

Researchers from Microsoft Threat Intelligence revealed the Star Blizzard group was recently seen phishing for WhatsApp accounts belonging to diplomats, government officials, defense policy or international relations researchers, and others who, in any capacity, work on the Russia - Ukraine war.

The campaign most likely started in mid-November 2024, with Microsoft warning all users always remain vigilant when dealing with email, especially those containing links to external resources.

Exfiltrating WhatsApp data

The attack starts with an email impersonating a US government official. The body of the email discusses the latest non-governmental initiatives aimed ...