Russian Star Blizzard hackers expand phishing campaigns worldwide

Russian hacking group Star Blizzard, linked to Russia's FSB, has broadened its cyber attacks from Ukraine-focused spear-phishing to large-scale phishing campaigns globally, according to Microsoft. Using a new method called RedFlick, they have targeted over 100 organizations, mostly in the US and UK, by sending fake event invitations that deliver a Windows backdoor named CosmicPulse. These attacks have primarily affected governments, think tanks, and NGOs since January 2026.

• Star Blizzard linked to Russian intelligence agency FSB
• Over 100 organizations targeted since January 2026
• Phishing emails impersonate event invitations from NGOs and think tanks
• RedFlick malware uses scheduled tasks to install CosmicPulse backdoor
• Targets now span beyond Ukraine to US, UK, and other countries