Star Blizzard (Threat actor): news timeline & CVEs

Russian hackers Star Blizzard expand targeting, change up tactics to reach Ukraine and beyond

Microsoft: FSB-linked Star Blizzard scaled RedFlick phishing to hundreds of emails per campaign, hitting over 100 mostly U.S. and U.K. organizations.

Microsoft reports that Star Blizzard, an FSB-affiliated espionage group also tracked as SEABORGIUM, Callisto Group, TA446, and COLDRIVER, shifted in 2026 to mass phishing campaigns of tens to hundreds of emails via an automated mass-mailing platform. The campaigns deploying new malware RedFlick affected over 100 organizations, primarily in the U.S. and U.K., plus Ukrainian government, NGO, and think-tank targets. RedFlick requires only a single user interaction and uses scheduled tasks to deploy the custom CosmicPulse backdoor. Microsoft observed at least 13 large-scale campaigns since January 2026, initially Ukraine-focused before expanding globally.

CyberScoop20:01 UTC · 2h agoThreat actor in the wild 3 sources

Russia's Star Blizzard Targets 100+ Organizations With Fake Event Invites to Deliver Backdoor

Microsoft says Star Blizzard ran 13 fake-event-invite campaigns since January, hitting 100+ Ukraine-linked organizations with the CosmicPulse backdoor via scheduled tasks.

Microsoft attributes at least 13 spearphishing campaigns since January to Russia's Star Blizzard (FSB Center 18), affecting over 100 organizations tied to Ukraine, mostly in the U.S. and U.K. The group uses hacked WordPress and cPanel email accounts and lures posing as Chatham House and Atlantic Council events; targets who reply receive password-protected RAR/ZIP archives with LNK files that fetch an MSI installer. The RedFlick loader creates three disguised scheduled tasks to install CosmicPulse, a Python-based backdoor; one March campaign delivered the DarkSword iPhone exploit kit instead. Microsoft published hunting queries and indicators, and secure-dns-hub[.]com was still active at publication.

The Hacker Newsupdated 20:01 UTC · 2h agofirst 17:20 UTC · 4h agoThreat actor in the wild 3 sources

Star Blizzard refines phishing and malware delivery with the RedFlick technique

Microsoft details Star Blizzard's RedFlick technique delivering CosmicPulse backdoor via single-click phishing lures, hitting 100+ organizations supporting Ukraine.

Microsoft reports Russian state actor Star Blizzard, attributed by CISA as subordinate to FSB Centre 18, shifted since January 2026 from targeted spear phishing to large-scale campaigns using accounts on compromised websites and a new delivery technique tracked as RedFlick. RedFlick initiates scheduled tasks to deploy the custom CosmicPulse backdoor after a single user interaction, replacing earlier multi-step ClickFix chains. Campaigns with lures such as fake Ukrainian tax-audit notices and closed-door policy roundtable invitations have affected over 100 organizations, primarily in the United States and United Kingdom, with a nexus to supporting Ukraine. The blog provides IOCs, detections, and hunting guidance for RedFlick-related activity.

Microsoft Security Blogupdated 20:01 UTC · 2h agofirst 15:00 UTC · 7h agoThreat actor in the wild 3 sources

Star Blizzard

Timeline3 articles

Appears with

Russian hackers Star Blizzard expand targeting, change up tactics to reach Ukraine and beyond

Russia's Star Blizzard Targets 100+ Organizations With Fake Event Invites to Deliver Backdoor

Star Blizzard refines phishing and malware delivery with the RedFlick technique