By 
Russian state-backed hacking group Star Blizzard has adopted a new tactic targeting WhatsApp users via malicious QR codes. Known for spear-phishing campaigns against government officials, diplomats, defense researchers, and organizations linked to Ukraine, this marks the group’s first use of WhatsApp as an attack vector.
Observed by Microsoft Threat Intelligence in November 2024, the campaign represents an evolution in Star Blizzard’s tactics. Historically, the group, also referred to as Callisto Group or ColdRiver, has used phishing emails to steal credentials and exfiltrate sensitive information.
In this operation, hackers sent emails posing as U.S. government officials, inviting recipients to join a WhatsApp group supporting Ukrainian NGOs. The emails included a QR code that, when scanned, appeared broken and prompted recipients to reply for further instructions.
After a response, the attackers sent a second email containing a shortened link wrapped in Microsoft Safe Links, which redirected victims to a webpage with another QR code. Scanning the code gave attackers unauthorized access to the victim's WhatsApp account by linking it to their own devices through WhatsApp Web. This allowed them to access private messages and extract data using browser plugins.
Sophisticated Tactics
The use of QR codes, a method known as "quishing," adds sophistication to their operations by bypassing traditional email security tools that cannot analyze hidden malicious URLs within QR codes. This tactic exploits the growing trust in QR codes, which saw widespread adoption during the pandemic.
Star Blizzard’s campaign follows significant disruptions to its infrastructure in October 2024, when Microsoft and the U.S. Department of Justice dismantled over 180 phishing domains used by the group. Despite this, the hackers quickly adapted, demonstrating their resilience and ability to innovate.
Target Profile
Star Blizzard's targets remain consistent:
- Government officials and diplomats
- Defense policy researchers
- NGOs and think tanks
- Individuals and organizations providing aid to Ukraine
The group uses open-source intelligence and social media to meticulously research targets, crafting convincing phishing lures by impersonating trusted contacts or prominent figures.
Mitigation Strategies
Microsoft recommends the following measures to counter such threats:
- Verify Email Authenticity: Confirm the sender’s identity through known channels before responding or clicking on links.
- Avoid Scanning QR Codes from Emails: Treat unsolicited QR codes with caution unless the source is verified.
- Use Phishing-Resistant MFA: Hardware security keys can block unauthorized access even if credentials are compromised.
- Educate Employees: Regular cybersecurity training can help users recognize phishing tactics.
- Deploy Advanced Security Solutions: Organizations should implement tools to detect sophisticated phishing attempts and monitor unusual activity.
Star Blizzard’s activities highlight the growing sophistication of state-sponsored cyber threats, which increasingly target sensitive sectors to gather intelligence, disrupt democratic processes, and influence geopolitical dynamics.
As attackers continue to evolve their methods, collaboration between governments and private entities is essential to fortify defenses and counteract these persistent adversaries.
