Russia's Star Blizzard targets 100+ groups with fake event invites to plant backdoor

September 29, 2026 at 10:20 PM2 min

This digest was compiled by AI from multiple sources — links to the originals are below.

Russian state hackers known as Star Blizzard have targeted more than 100 organizations since January using fake event invitations to deliver a Windows backdoor, according to Microsoft. The campaigns, aimed at people and organizations tied to Ukraine, have affected mostly U.S. and U.K. entities. At least one computer was infected, but the number of breached organizations has not been disclosed.

Key Facts

Microsoft attributed the campaigns to Star Blizzard, a Russian state hacking group linked to Center 18 of Russia's Federal Security Service (FSB).
The campaigns have affected more than 100 organizations since January, mostly in the U.S. and U.K.
Microsoft counted at least 13 larger campaigns this year, each with tens to hundreds of emails, on top of the group's usual targeted phishing.
Since March, the campaigns have used email accounts on WordPress and cPanel websites, which Microsoft is highly confident the group hacked for that purpose.
In 2025, the group delivered malware through fake CAPTCHA pages using a method known as ClickFix; this year it switched to a method Microsoft calls RedFlick, which uses scheduled tasks to install a backdoor named CosmicPulse.

Campaign Tactics

The invitations name well-known think tanks or NGOs as hosts, such as Chatham House and the Atlantic Council. Many emails are written to appear to come from within the target's organization. The first email usually carries no attachment; if the target replies, the group sends a password-protected RAR or ZIP archive, with the password shown in an image. The first campaigns, in January and February, posed as Ukrainian authorities and sent fake tax audit and fine notices to users of the Ukrainian email service Ukr.net. Later lures included a water shutdown notice for hotels in Kyiv and a payment notice for staff at an international financial organization.

Infection Chain

Microsoft traced several versions of the infection chain; in all of them, a shortcut (LNK) file disguised as a PDF initiates the attack, and a Windows Installer (MSI) package sets up scheduled tasks. One March campaign worked differently: people who replied to an Atlantic Council-themed invitation got a link to DarkSword, an iPhone exploit kit, instead of the Windows backdoor, according to Microsoft. Proofpoint reported Atlantic Council-themed emails from the group in March, along with a sharp rise in its email volume. Trellix found 4 such emails sent on March 26; its confidence that the emails led to DarkSword is medium, because the exploit pages were offline and no exploit code was recovered.