What changed

Star Blizzard, a Russian group tracked by Microsoft as a cyberespionage actor, has expanded its phishing operations. Instead of relying only on individually tailored messages, it has sent larger batches: Microsoft reports campaigns ranging from dozens to hundreds of emails. Many pose as conference or professional-event invitations; others use tax-audit or fine notices. To a recipient, they can look like ordinary work correspondence. Source: Microsoft Threat Intelligence analysis.

Since January 2026, Microsoft has observed at least 13 such campaigns and activity affecting more than 100 organizations, primarily in the United States and United Kingdom. Targets included Ukrainian individuals and institutions, NGOs, think tanks, governments, and financial institutions that support Ukraine. This figure describes observed activity and targets; it does not mean that every one of those organizations was successfully breached, nor that the campaign is indiscriminate spam aimed at all businesses. Context: CyberScoop on the campaign’s expanded reach.

RedFlick shortens the attack chain

Microsoft uses the name RedFlick for a newer malware-delivery method. Earlier approaches often required several actions from the target. In observed cases, an email exchange can now lead to a password-protected archive; after the user interacts with it, a chain of Windows scheduled tasks delivers the CosmicPulse backdoor. Microsoft describes this flow as requiring a single user interaction. That does not mean that merely viewing any email infects a computer. Details: Microsoft’s analysis of RedFlick and defenses.

Another change is the use of accounts created on compromised legitimate websites to send messages. An email may therefore not come from a domain already known to security filters as suspicious. Microsoft also reports impersonation of trusted contacts and multiple delivery methods. A message about a colleague, conference, or financial matter still needs verification even when it looks professional. Source: Microsoft guidance for organizations at risk.

What this means for companies

Organizations connected to government, international policy, support for Ukraine, nonprofits, and financial services should pay closest attention. Businesses outside these groups can still take away a practical lesson: attackers are combining plausible pretexts, a larger pool of recipients, and a less obvious technical delivery chain. Cybersecurity cannot rely only on staff spotting spelling mistakes or on email coming from an unfamiliar domain. Source: Microsoft on the targets and campaign changes.

Microsoft recommends phishing-resistant sign-in and device protection. For a company’s own readiness, it also matters who handles suspicious-message reports, how unexpected invitations are verified, and whether the security team can spot unusual Windows scheduled tasks or files launched from archives. Microsoft’s specific indicators relate to the campaign it observed; not finding them does not by itself prove an environment is safe. Guidance: Microsoft Threat Intelligence.

Three practical steps

  1. Verify unexpected invitations through another channel. If a message asks you to open an archive or document, confirm it with a known contact or internal channel; do not use a suspicious email as your only verification method.
  2. Strengthen sign-in and email protection. Prefer phishing-resistant MFA, block legacy sign-in methods, and tune attachment and link checks to the risk of each user group.
  3. Prepare a response for the moment someone clicks. Make reporting simple, define how to isolate a suspicious device quickly, and check for new scheduled tasks, files launched from archives, and unusual network connections.

Closing

The Star Blizzard case shows that phishing can change both the credibility of its pretext and the way malicious code is delivered. Companies can reduce confusion by rehearsing how to verify an unusual message and deciding in advance what happens after someone reports one.

Sources