Dancing Salome

ACTIVE CAMPAIGN TRACKED ▲ High Threat Russia

Primary Aliases: Bleeding Bear Cadet Blizzard DEV-0586 DEV-0587

Sponsor / State Affiliation Russian Federation (GRU)

Primary Motivation Espionage and political intelligence collection

Confidence Rating 90% (Grounded)

Cloud-Infrastructure Payload Delivery, Media and NGO Espionage Campaign

🎯 Target Sectors & Focus

Government agencies Diplomatic entities Media organizations Think tanks Non-Governmental Organizations (NGOs) Defense and security sectors

🛡️ MITRE ATT&CK® Attack Lifecycle (6 TTPs)

📥 Download Navigator JSON

Initial Access 1

T1566 Spear-phishing

Credential Access & Discovery 2

T1003 Credential harvesting via deceptive login pages

T1003 Social engineering through highly personalized messaging

Command & Control 1

T1071 Custom malware deployment

Operational Techniques 2

T1000 Living off Trusted Sites (LoTS) using Google Drive, Dropbox, and OneDrive

T1000 Exploitation of webmail and document sharing services

📰 Verified Campaigns & Intelligence Archive

🔔 Subscribe to Alerts

[DEEP DIVE] Star Blizzard Scales Phishing Operations with RedFlick Malware Delivery

Strategies and Tactics 2026-10-03

Copied to clipboard

LINK COPIED TO CLIPBOARD