Microsoft reports Russia-linked Star Blizzard sent fake event invitations and other business notices to trick targets into opening disguised files that install a Windows backdoor. The campaigns targeted Ukraine-linked people and organizations and hit 100+ organizations, mainly in the U.S. and U.K., using multi-step email exchanges and password-protected archives to bypass defenses.
Star Blizzard's campaigns relied on a slow build rather than an immediate strike. The first email typically carried no attachment at all, functioning purely to start a conversation and establish trust. Only after the target replied did the attacker send a password-protected RAR or ZIP archive, with the password conveniently shown in an image rather than in text. This step alone defeats many automated scanning tools that look for readable passwords or malicious content inside archives.
Inside that archive was a shortcut (LNK) file disguised as a PDF. Opening it triggered a chain that fetched a Windows Installer (MSI), which created scheduled tasks to install the CosmicPulse backdoor. Some March-era replies instead led to a link for an iPhone exploit kit, showing the group adapted its payload depending on the target's device.
The lures were built around credible, topical pretexts. Some invitations named well-known think tanks and NGOs, such as Chatham House and the Atlantic Council, as event hosts. Other waves impersonated Ukrainian authorities with fake tax audit and fine notices sent to users of a Ukrainian email service, or used a water shutdown notice aimed at hotels in Kyiv. These pretexts matched the professional context of the targeted policy staff, executive assistants, finance teams, and hotel operations personnel, making the initial emails feel routine rather than suspicious.
The multi-step structure also worked against typical email security controls. Because the first message had no attachment, it passed scanning easily. By the time the archive arrived, the recipient had already replied and was primed to open whatever came next.
Organizations supporting Ukraine-related work, along with policy, NGO, and government staff, should treat reply-triggered attachments as a specific risk category. Encourage staff to verify unexpected invitations or official notices through a phone number or email address they already know, rather than replying directly to the message. Reporting unusual shortcut files or password-protected archives before opening them can stop the chain before the scheduled tasks and backdoor installation occur. Building awareness around these specific mechanics, the reply-then-attach pattern, image-based passwords, and disguised shortcuts, gives staff concrete signals to act on rather than vague suspicion.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
The group sent an initial email with no attachment to start a conversation, then followed up with a password-protected RAR or ZIP archive after the target replied, with the password shown in an image so scanners could not read it.
In every case the payload was a shortcut (LNK) file disguised as a PDF, which fetched a Windows Installer that created scheduled tasks to install the CosmicPulse backdoor.
Campaigns targeted Ukraine-linked people and organizations, including think tanks, NGOs, government bodies, and hotels in Kyiv, hitting over 100 organizations mostly in the U.S. and U.K.
Watch for emails that build a conversation before sending anything, password-protected archives with an image-based password, PDF-looking files that are actually shortcuts, and sender addresses where the real organization's name appears before the @ sign rather than in the domain.
You get this email: “Invitation, Atlantic Council event (details enclosed).” Looks legit, right? That’s exactly how the Star Blizzard backdoor starts. If you reply, they send a password‑protected ZIP or RAR. The password is shown in an image, and inside there’s a so‑called PDF that’s actually a shortcut file, an LNK, that pulls down a Windows installer and plants the CosmicPulse backdoor. They’ve also faked Ukrainian tax audit and fine notices to Ukr.net users, and used domains like secure-dns-hub[.]com that look technical but aren’t official. The pattern is the same: no file at first, then a password‑protected archive and a fake PDF that behaves like a program. Here’s the move: if a “PDF” from an invite or notice comes inside a password‑protected ZIP or RAR, stop. Don’t open it, forward the email to security and let them handle it.
Microsoft reports that the Russian state-linked actor Star Blizzard ran large-scale phishing campaigns in 2026 that use convincing lures like tax notices, fines, and “closed-door” event invitations. After a victim replies, the attacker sends a password-protected ZIP/RAR attachment that triggers a…
FortiGuard Labs reports an active phishing operation (“TTF Trap”) where emails posing as invoices, shipping documents, or business proposals deliver an archive that ultimately runs malware on Windows. The trick is a file ending in .ttf (TrueType font) that is actually a malicious script executed by…
Investigators found evidence of a China-linked operation (tracked as JadeProx) targeting government, healthcare, and education organizations, including spear-phishing and a fake software download site. One campaign impersonated Anthropic’s Claude using a lookalike domain to deliver a malicious…
Proofpoint linked multiple real-world email campaigns to “Cruciferra,” a commercial crypter service that helps criminals hide malware from security tools. The campaigns used familiar social-engineering themes, tax documents, U.S. Social Security Administration messages, and even bed-bug complaints,…
Researchers say the North Korea-linked Lazarus group ran “Operation Dream Job,” posing as recruiters and sending fake job offers to lure targets into downloading trojanized PDF tools and opening booby-trapped PDFs. The campaign focused largely on defense-related organizations and used both a…
This weekly recap highlights multiple real-world campaigns where attackers trick users into taking actions that grant access, without needing to steal passwords directly. Notable examples include “device code” phishing (victims are instructed to enter a short code to approve an attacker session)…
