01. The intelligence operation behind the inbox

On December 7, 2023, the United States Department of Justice announced charges against Ruslan Aleksandrovich Peretyatko and Andrey Stanislavovich Korinets. Prosecutors identified Peretyatko as an officer in Center 18 of Russia’s Federal Security Service, the FSB, and alleged a computer intrusion conspiracy operating on behalf of the Russian government.

The indictment described targeting between at least October 2016 and October 2022, including current and former members of the American intelligence community, Defense and State Department personnel, defense contractors and Department of Energy facilities. It also alleged that information taken from some targeted accounts was leaked before Britain’s 2019 elections. These are criminal allegations, not findings of guilt.

The case gives the story a concrete institutional foundation. Its subject is a documented prosecution concerning Russian cyber espionage, rather than an inference drawn from political proximity or disputed personal relationships.

02. Why the person becomes the perimeter

A joint advisory published by the United Kingdom’s National Cyber Security Centre and international partners assessed that Star Blizzard was almost certainly subordinate to FSB Center 18. It described an operation built around researching individuals, impersonating familiar contacts and developing believable exchanges before attempting to obtain account access.

The advisory noted a preference for personal email addresses, although business accounts were also targeted. Stolen correspondence and contact lists could then support further approaches to other people. A compromised relationship could become an entry point into another relationship.

The NSA’s accompanying warning emphasised the risk posed by personal accounts belonging to people with information valuable to Russia. Its target profile extended beyond government to academia, defense, think tanks, politicians and civil society.

The strategic implication is that institutional boundaries do not contain every useful conversation. A researcher or former official may retain contacts and insight after leaving a sensitive post. That makes the surrounding professional network an intelligence target in its own right.

03. What this establishes about Washington

The American case places intelligence, diplomacy, defense and energy within the alleged targeting picture. It does not establish that Star Blizzard recruited a source inside the White House, penetrated a presidential classified network or obtained a particular presidential briefing.

Targeting also needs to be distinguished from successful compromise. A list of intended victims cannot be treated as a list of stolen secrets. Publicly described access to some accounts does not establish access to every institution associated with their owners.

For this dossier, Washington describes the American national security and policy community. It is not a claim that investigators have exposed an FSB mole in the presidential administration.

04. The October 2024 disruption

On October 3, 2024, the Justice Department announced a warrant authorising the seizure of 41 internet domains associated with the operation. It coordinated the intervention with a Microsoft civil action concerning another 66 domains.

The department said the supporting affidavit described an ongoing campaign against government and other victims. The action targeted infrastructure used to enable intrusions. It did not mean the people directing the campaign had been arrested or that the operation had permanently ceased.

Microsoft’s account of the intervention stressed the group’s persistence and ability to move to replacement domains. The company also described cooperation with the NGO Information Sharing and Analysis Center, reflecting the exposure of organisations outside government.

This illustrates a practical counterintelligence problem: removing infrastructure can interrupt collection without removing the organisation responsible for it.

05. A subsequent move toward WhatsApp

In research published on January 16, 2025, Microsoft described a limited Star Blizzard campaign observed in November 2024. Messages impersonating a United States government official offered access to a supposed WhatsApp group connected with support for Ukraine.

The invitation instead sought to trick recipients into linking their WhatsApp account to a device controlled by the attacker. Microsoft said this could expose messages without requiring the attacker to defeat the application’s encryption itself.

The company reported that the campaign appeared to end in late November. It assessed the change as a possible response to public exposure of the group’s earlier methods. That assessment should not be turned into proof of uninterrupted activity throughout 2025 or 2026.

The episode adds a revealing detail: the service or application may change while the approach still depends on an apparently credible human invitation.

06. The boundary that matters

The Star Blizzard dossier shows how a foreign intelligence campaign can pursue access through the everyday communications surrounding state power. Its significance lies in the overlap between personal trust and professional knowledge.

The public record supports a serious account of FSB linked espionage against American targets. It also leaves clear limits around individual guilt, specific losses and claims about the White House. Keeping those limits visible makes the documented operation easier to understand.

SHADOW PROTOCOLSOPEN CHRONICLE MAGAZINEUnderstanding the hidden architecture of global power.RETURN TO SHADOW PROTOCOLS →