Microsoft reports that the Russia-linked group Star Blizzard expanded from highly targeted spear-phishing to larger email campaigns aimed at Ukraine supporters globally. Lures included tax-audit/unpaid-fine notices and fake conference invitations, followed by a password-protected archive that installs malware with just one click.
Star Blizzard, also tracked as Callisto or ColdRiver and linked to Russia's FSB, shifted from narrowly targeted spear-phishing to broader email campaigns sent in batches of tens or hundreds at a time. Early campaigns in January and February targeted users of the Ukrainian email provider Ukr.net, impersonating Ukrainian authorities with claims that the recipient faced a tax audit or had an unpaid fine. Beginning in March, the group broadened its targeting beyond Ukraine, using fake invitations to conferences or events supposedly organized by reputable think tanks or NGOs. In some cases, several people at the same organization were targeted, with messages disguised as internal communications.
Once a victim replies to one of these initial lures, Star Blizzard sends a follow-up containing a password-protected archive. Opening a file inside that archive triggers RedFlick, which uses scheduled tasks on the victim's computer to install the group's CosmicPulse backdoor while making the activity harder to detect. Notably, this method requires only one action from the victim, a simpler path to compromise than the group's earlier approach.
This attack succeeds because it layers believable pretexts on top of social engineering rather than relying on technical exploits. Threats of a tax audit or fine create urgency that pushes recipients to respond without verifying the sender. Conference invitations exploit professional curiosity and the credibility people associate with think tanks and NGOs. Using accounts created on compromised websites, rather than only impersonating free webmail providers, also helps the lures appear more legitimate. Once a reply is sent, the password-protected archive can slip past some automated scanning, and the single-click installation reduces the number of decisions a victim has to make before compromise occurs.
Staff across government, NGO, think tank, finance, and policy roles should treat replies to unsolicited audit, fine, or invitation emails as the first risk point, not just attachment handling. Verify claims of fines or audits through known official channels rather than by replying. Train employees to escalate password-protected archives to IT or security for inspection instead of opening them directly, and reinforce that an internal-looking email does not guarantee a legitimate sender, especially when multiple colleagues receive similar messages.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
Star Blizzard, also known as Callisto or ColdRiver and linked to Russia's FSB, expanded from highly targeted spear-phishing to larger campaigns sending tens or hundreds of emails at a time.
Early campaigns impersonated Ukrainian authorities with claims of a tax audit or unpaid fine, while later campaigns used fake invitations to conferences or events supposedly organized by reputable think tanks or NGOs.
After a victim replies to the initial phishing email, the attacker sends a password-protected archive. Opening a file inside it triggers RedFlick, which uses scheduled tasks to install the CosmicPulse backdoor, requiring only one action from the victim.
The new delivery method requires only one action from the victim, compared to the group's prior approach, and the password-protected archive can help the malicious file bypass email scanning.
You get an email: “Notice: You are subject to a tax audit” or “unpaid fine.” Looks urgent, looks official… and it’s a trap. This is Star Blizzard using their RedFlick trick: you reply, they send a password‑protected archive, you open it once, and it quietly installs their CosmicPulse backdoor. Same move with fake conference invites: “Invitation: Conference registration details” from a think tank or NGO, or even phrased like an internal email, all pushing you to reply so they can send that archive. If any audit, fine, or invite email leads to a password‑protected archive, stop and forward it to IT or Security, do not open it.
Microsoft reports that the Russian state-linked actor Star Blizzard ran large-scale phishing campaigns in 2026 that use convincing lures like tax notices, fines, and “closed-door” event invitations. After a victim replies, the attacker sends a password-protected ZIP/RAR attachment that triggers a…
Researchers report real-world campaigns targeting European government and diplomatic organizations using diplomatic-themed Microsoft Word documents. Victims are prompted to click “Enable Content,” which runs malicious macros that install the HOOKEDGE backdoor and connect to webhook-based…
Microsoft reports real-world Star Blizzard phishing campaigns where victims who engage with an initial email receive a follow-up message containing a password-protected ZIP/RAR attachment. The attachment chain hides a malicious shortcut disguised as a PDF, opening a decoy file while quietly…
Microsoft reports Russia-linked Star Blizzard sent fake event invitations and other business notices to trick targets into opening disguised files that install a Windows backdoor. The campaigns targeted Ukraine-linked people and organizations and hit 100+ organizations, mainly in the U.S. and U.K.,…
AhnLab reports Larva-24009 has continued phishing campaigns through 2026, sending emails that trick employees into opening fake “document” attachments that are actually shortcut (LNK) files. When opened, the attachment runs hidden PowerShell commands, shows a decoy document, and silently downloads…
FortiGuard Labs reports an active phishing operation (“TTF Trap”) where emails posing as invoices, shipping documents, or business proposals deliver an archive that ultimately runs malware on Windows. The trick is a file ending in .ttf (TrueType font) that is actually a malicious script executed by…
