Star Blizzard, a Russian state-backed hacking group linked to the FSB, has significantly expanded its phishing operations against Ukraine supporters globally. As of September 2026, Microsoft reports that the group has targeted over 100 organizations across the U.S. and UK, shifting from isolated spear-phishing to automated mass-mailing campaigns and introducing a streamlined malware delivery mechanism named RedFlick.
From Targeted Spear-Phishing to Mass-Mailing Platforms
For years, the threat actor known alternately as Star Blizzard, Callisto, and ColdRiver operated with a heavy focus on high-precision, individualized spear-phishing. Active since at least 2017, the group specialized in compromising government agencies, non-governmental organizations, and think tanks through meticulously crafted emails sent from free email services. Those early operations relied heavily on impersonating trusted political figures, academics, or former diplomats.
That manual playbook changed at the start of 2026. Security researchers observed a sharp pivot toward volume. Instead of single emails, Star Blizzard began deploying campaigns involving tens or hundreds of messages at a time. This operational scaling points directly to the adoption of a mass-mailing phishing platform, allowing the actors to automate infrastructure deployment and cast a much wider net.
Microsoft identified at least 13 large-scale campaigns leveraging this automated setup since January. The shift initially manifested in attacks targeting users of the Ukrainian email provider Ukr.net, where hackers impersonated local authorities to push fake tax audits or unpaid fine notifications. By March, however, the target demographic widened dramatically.
Global Targeting of Ukraine Allies and Think Tanks
The campaign footprint quickly expanded beyond Ukrainian borders to strike international supporters. Financial institutions, government ministries, and policy organizations providing political or financial backing to Ukraine found themselves in the crosshairs. The threat actors modified their vector, frequently utilizing accounts generated on compromised websites to dispatch fake conference invitations.
In several instances observed by analysts, the campaigns targeted multiple individuals within the same organization, disguising the outbound phishing lures as internal corporate or institutional communications.
The progression suggests a deliberate testing phase. Initial operations focused on Ukraine likely served as a live-fire environment for the group to test new capabilities before deploying them on a global stage against Western institutions and international NGOs.
The RedFlick and CosmicPulse Infection Chain
Technical execution has also undergone a structural overhaul. Earlier iterations of Star Blizzard attacks relied on an infection method designated as ClickFix, which forced victims to execute a multi-step sequence of manual actions before malware could anchor itself to the target machine.
That multi-step hurdle has been replaced by RedFlick. When a target replies to an initial phishing message, the attackers follow up with a password-protected archive. Opening a file nestled inside this archive silently triggers RedFlick. The utility immediately provisions scheduled tasks on the compromised workstation to install the group’s signature CosmicPulse backdoor, drastically cutting down the required victim interaction to a single action while masking background execution.
- Initial Lure: Phishing emails sent via compromised website accounts or fake internal communications.
- Payload Delivery: Password-protected archives containing the RedFlick execution script.
- Persistence: Automated scheduled tasks establishing the CosmicPulse backdoor with minimal user friction.
By streamlining the attack chain from a cumbersome multi-step process into a single-action compromise, Star Blizzard has measurably improved its operational efficiency. The integration of mass-mailing infrastructure with RedFlick highlights an evolving threat landscape where state-backed groups continuously refine their tradecraft to maximize dwell time and evade automated detection systems.
