Star Blizzard Shifts to Mass Phishing Campaigns in 2026
Microsoft research published in early 2026 reveals that the Russian government-linked hacking group Star Blizzard has significantly evolved its tactics, moving beyond traditional spear-phishing to conduct large-scale phishing operations targeting organizations worldwide. The shift, observed since January 2026, marks a strategic expansion in both volume and geographic reach, with particular emphasis on entities supporting Ukraine.
The group, which Microsoft identifies as affiliated with the Russian Federal Security Service (FSB), has adopted automated mass-mailing platforms to distribute phishing lures at unprecedented scale, sending tens to hundreds of emails per campaign. This approach increases the likelihood of compromise by broadening the initial targeting pool beyond the highly selective methods used in prior years.
RedFlick Malware Enables Stealthy, Single-Click Compromise
A key factor in the effectiveness of these campaigns is the deployment of a novel malware strain dubbed RedFlick. Unlike multi-stage attacks requiring several user actions, RedFlick’s infection flow requires only a single interaction — such as clicking a link in a phishing email — to initiate compromise.
Once activated, RedFlick establishes persistence by creating scheduled tasks that deploy CosmicPulse, Star Blizzard’s custom backdoor, allowing attackers to maintain long-term access while evading detection. Microsoft notes that this technique represents a significant adaptation in the group’s tradecraft, blending social engineering with stealthy payload delivery.
Global Targeting Expands Beyond Ukraine to NATO Allies and Institutions
While initial RedFlick campaigns in early 2026 focused on Ukrainian individuals and organizations, the scope broadened by spring to include governmental bodies, think tanks, financial institutions, and non-governmental organizations in the United States, United Kingdom, and other nations that have provided support to Ukraine following Russia’s 2022 invasion.
Microsoft confirmed that over 100 organizations have been affected by these campaigns, with the majority located in the U.S. and U.K. The targets span sectors critical to national security and policy-making, reflecting Star Blizzard’s interest in intelligence collection related to Western responses to the war in Ukraine.
Phishing Lures Exploit Trust Through Fake Events and Financial Pretenses
The most common lure used in these phishing emails invites recipients to exclusive events, such as private briefings or diplomatic gatherings. However, Star Blizzard also employs themes involving fake tax audits, payment notices, and fines to trick users into engaging with malicious content.
By combining credible-sounding pretexts with high-volume distribution, the group increases the probability that at least some targets will interact with the lures, enabling initial access even among security-conscious individuals.
Star Blizzard’s Evolving Identity and History of Microsoft Warnings
This is not the first time Microsoft has publicly attributed cyber operations to Star Blizzard. The company previously tracked the group in 2023 and 2025, and participated in takedown efforts during 2024. Over time, the actor has been known by multiple aliases in threat intelligence circles, including SEABORGIUM, Callisto Group, TA446, and COLDRIVER.
The consistent re-emergence of this group under different names underscores the persistence of FSB-linked cyber espionage efforts and their ability to adapt tools and tactics in response to defensive measures. Microsoft’s 2026 findings highlight a clear trend: state-sponsored actors are increasingly leveraging automation and malware innovation to scale their operations while reducing reliance on labor-intensive, highly targeted methods.
Source: CyberScoop