Star Blizzard Expands Phishing Campaigns With RedFlick and CosmicPulse
Summary
Microsoft says FSB-linked Star Blizzard has shifted to larger-scale phishing, targeting over 100 organizations, especially Ukraine-linked groups and supporters. RedFlick delivers the CosmicPulse backdoor via scheduled tasks.
Key points
- Microsoft observed Star Blizzard move beyond targeted spear-phishing to campaigns sending tens to hundreds of emails.
- Since January 2026, Microsoft observed at least 13 large-scale campaigns, primarily targeting NGOs, think tanks, and government organizations.
- Microsoft reported activity affecting more than 100 organizations, primarily in the U.S. and U.K., including Ukraine-linked organizations and Ukraine supporters.
- RedFlick campaigns use lures such as exclusive-event invitations, supposed tax audits, payment notices, and fines.
- Microsoft says RedFlick uses scheduled tasks to deploy the custom CosmicPulse backdoor and that the infection flow requires one user interaction.
Article Details
- Attack Vectors
- Star Blizzard used larger-scale phishing campaigns, with lures involving exclusive events, supposed tax audits, payment notices, and fines.
- RedFlick uses scheduled tasks to deploy the CosmicPulse backdoor.
MITRE ATT&CK
Threat Actors
Callisto GroupNamed in the article as another name for Star Blizzard.COLDRIVERNamed in the article as another name for Star Blizzard.SEABORGIUMNamed in the article as another name for Star Blizzard.Star BlizzardMicrosoft identifies this FSB-affiliated group as conducting the phishing campaigns.TA446Named in the article as another name for Star Blizzard.
Malware
CosmicPulseMicrosoft says Russian FSB-linked Star Blizzard has expanded from targeted spear-phishing to larger-scale phishing campaigns using the RedFlick delivery method and CosmicPulse backdoor.RedFlickMicrosoft says Russian FSB-linked Star Blizzard has expanded from targeted spear-phishing to larger-scale phishing campaigns using the RedFlick delivery method and CosmicPulse backdoor.
Countries
UkraineThe activity has hit more than 100 organizations, with a focus on Ukraine, NGOs, think tanks, governments, and supporters of Ukraine in the U.S.United KingdomIt said it has seen the activity affect over 100 organizations that are primarily in the United States or United Kingdom.United StatesIt said it has seen the activity affect over 100 organizations that are primarily in the United States or United Kingdom.
Industries
Financial institutionsMicrosoft said the RedFlick campaigns have targeted Ukrainians, as well as financial institutions and governments that have supported Ukraine.GovernmentA group of Russian government hackers is refining its attacks to make it easier to eavesdrop on victims and significantly expand its targets among governments, think tanks and nonprofits around the world, with anThink tanksThe activity has hit more than 100 organizations, with a focus on Ukraine, NGOs, think tanks, governments, and supporters of Ukraine in the U.S.