Reported by 16 outlets

Timeline

1. original reporting

   Russian APT Star Blizzard Uses ‘RedFlick’ Infection Chain in Recent Attacks

   securityweek.com · 13d ago · September 30th, 2026

   Russian state-sponsored APT Star Blizzard has updated its tactics, techniques, and procedures (TTPs) in recent attacks to evade detection, Microsoft says. Believed to be subordinate to the Russian Federal Security Service (FSB) Centre 18, Star Blizzard is known for launching targeted spear-phishing campaigns against academia, defense, governmental organizations, NGOs, and think tanks, and for using the ClickFix technique and the DarkSword iOS exploit kit . In attacks observed this year, the APT has been relying on large-scale phishing attacks and a new malware delivery technique dubbed RedFlick , which requires a single user interaction for malware execution. If the recipient responds to the initial phishing email, Star Blizzard sends a second message containing a password-protected RAR or ZIP archive that triggers the malware delivery. The state-sponsored group has been using the technique in attacks against Ukrainian individuals and institutions, as well as international NGOs, think tanks, governments, and financial institutions that have been providing support to Ukraine. Star Blizzard, Microsoft says, has been creating accounts on compromised websites to send tens to hundreds of phishing emails per campaign, likely through a mass-mailing phishing platform. Between January and August 2026, the APT launched over a dozen campaigns containing a RedFlick lure attachment, posing either as Ukrainian authorities or a reputable think tank

2. update from cisa.gov

   Russian FSB Cyber Actor Star Blizzard Continues Worldwide Spearphishing Campaigns (AA23-341A)

   cisa.gov · 1042d ago · December 7th, 2023

   Joint advisory from CISA, the FBI, the NSA, the UK NCSC and four other national cyber agencies assessing that Star Blizzard (formerly SEABORGIUM, also known as Callisto, TA446, COLDRIVER, TAG-53 and BlueCharlie) is almost certainly subordinate to Russian FSB Centre 18. It documents Evilginx-based credential spearphishing against academia, defense, government, NGOs, think tanks and politicians since 2019, including session cookie theft and mail-forwarding rules for persistence.

3. update from microsoft.com

   Star Blizzard increases sophistication and evasion in ongoing attacks

   microsoft.com · 1042d ago · December 7th, 2023

   Microsoft detailed Star Blizzard's evasion upgrades: multi-registrar domain infrastructure, layered link-shortener and open-redirect chains feeding Evilginx servers, and altered OneDrive share notifications as lures. The post also carries a large table of actor-registered domains with registrar and TLS certificate metadata, useful for retrospective DNS and proxy log hunting.

4. update from securityweek.com

   CISA Issues Warning for Russian 'Star Blizzard' APT Spear-Phishing Operation

   securityweek.com · 1041d ago · December 7th, 2023

   CISA and partner agencies issued joint advisory AA23-341A attributing Star Blizzard to Russia's FSB Centre 18 and warning of spear-phishing against academia, defense, government, NGOs, and think tanks in the US, UK, NATO countries, and states neighboring Russia. The advisory described methodical research and rapport-building before credential theft, often to victims' personal email addresses to bypass corporate controls. It also noted 2022 expansion into defense-industrial targets and US Department of Energy facilities.

5. update from microsoft.com

   New Star Blizzard spear-phishing campaign targets WhatsApp accounts

   microsoft.com · 636d ago · January 16th, 2025

   Microsoft reported a November 2024 Star Blizzard pivot from pure email credential theft to QR-code phishing that abused WhatsApp device linking to read victims' messages, impersonating a US government official. It also noted that Microsoft and the US DOJ had seized or taken down more than 180 Star Blizzard websites since October 3, 2024, and that the actor rebuilt on new domains within days.

6. update from securityweek.com

   Russia-Linked APT Star Blizzard Uses ClickFix to Deploy New LostKeys Malware, Google Warns

   securityweek.com · 523d ago · May 8th, 2025

   Google reported that Star Blizzard used fake CAPTCHA pages and the ClickFix technique to deliver a new malware family named LostKeys in campaigns observed in January, March, and April 2025 against advisors to Western governments, journalists, think tanks, and NGOs. LostKeys steals files from a hard-coded list of extensions and directories and was deployed only in highly selective cases. This documents the multi-step malware delivery tradecraft that RedFlick later replaced.

7. update from zscaler.com

   COLDRIVER Updates Arsenal with BAITSWITCH and SIMPLEFIX

   zscaler.com · 385d ago · September 24th, 2025

   Zscaler ThreatLabz documented a ClickFix campaign attributed with moderate confidence to COLDRIVER delivering the BAITSWITCH downloader DLL and the SIMPLEFIX PowerShell backdoor via the C2 domains captchanom[.]top and southprovesolutions[.]com. The chain used rundll32 execution, UserInitMprLogonScript logon-script persistence and RunMRU clearing, the delivery lineage that Microsoft now folds into its CosmicPulse reporting.

8. update from cloud.google.com

   To Be (A Robot) or Not to Be: New Malware Attributed to Russia State-Sponsored COLDRIVER

   cloud.google.com · 359d ago · October 20th, 2025

   Google Threat Intelligence Group attributed the NOROBOT downloader (disclosed by Zscaler as BAITSWITCH) and the YESROBOT and MAYBEROBOT backdoors to COLDRIVER, noting the actor began re-arming five days after the May 2025 LOSTKEYS disclosure. The chain fetches a full Python 3.8 package, stores split AES keys in the registry and persists via a scheduled task, the same architecture Microsoft later describes as the CosmicPulse downloader and backdoor.

9. update from x.com

   Proofpoint Threat Insight on Star Blizzard DarkSword iOS backdoor

   x.com · 200d ago · March 27th, 2026

   Proofpoint Threat Insight reported that Star Blizzard targeted vulnerable Apple iOS devices to deploy the DarkSword backdoor, as cited by Microsoft's September 2026 RedFlick report; the post timestamp is derived from the status ID embedded in that citation. Microsoft's campaign timeline shows a matching March 2026 lure, an Atlantic Council closed-door discussion invitation, that delivered a link to DarkSword installation instead of a RedFlick attachment.

10. update from securityweek.com

    Russian APT Star Blizzard Adopts DarkSword iOS Exploit Kit

    securityweek.com · 197d ago · March 30th, 2026

    Messages sent from compromised sender addresses redirected iPhone browsers to the DarkSword exploit kit, which had leaked on GitHub, for credential harvesting and intelligence collection. Proofpoint also noted a significant increase in malicious email volume over the preceding two weeks.

11. update from dslua.org

    Spearphishing via Fake URC 2026 Invitations Targets Ukrainian CSOs

    dslua.org · 113d ago · June 23rd, 2026

    Digital Security Lab Ukraine documented a spearphishing campaign active from June 10, 2026 that impersonated politician Pawel Kowal and the Ukraine Recovery Conference to target Ukrainian civil society. The chain used a reply-gated password-protected ZIP containing a Files.vhdx disk image, an LNK with its script hidden in the Description field, and four scheduled tasks including SecureDNSObserver, with WebDAV delivery from 89[.]125[.]66[.]183 and remote command sources 103[.]160[.]59[.]97 and secure-dns-hub[.]com. These techniques and IoCs overlap with what Microsoft later folded into its RedFlick reporting, making this the earliest public documentation of the chain.

12. update from microsoft.com

    Star Blizzard refines phishing and malware delivery with the RedFlick technique

    microsoft.com · 15d ago · September 29th, 2026

    It counts at least 13 large-scale campaigns from January to August 2026 affecting over 100 organizations, primarily in the United States and United Kingdom. The post provides detections, hunting queries, and IoCs, including C2 IP 103.245.213[.]217, the registry key HKCU\Software\Classes.mollis, and scheduled task names Internet Quality Test Connection, Network Configuration Manager, and System Health Monitor.

13. update from microsoft.com

    Star Blizzard refines phishing and malware delivery with the RedFlick technique

    microsoft.com · 14d ago · September 29th, 2026

    These changes represent a notable shift in the actor’s operational tradecraft and support ongoing cyberespionage activity targeting Ukrainian individuals and institutions as well as international non-government organizations (NGOs), Western think tanks, governments, and other organizations associated with international policy—particularly those with a nexus in supporting Ukraine. This technique is a notable departure from the actor’s previous use of ClickFix-based infection chains which required victims to complete multiple actions before CosmicPulse could be installed. By contrast, the RedFlick infection flow only requires a single user interaction, reducing friction in the compromise process. Combined with the actor’s shift toward large-scale phishing operations during the same period, these changes likely

14. mentioned by www.microsoft.com

    (microsoft.com) Evolution of Star Blizzard: RedFlick Malware Delivery and Large-Scale Phishing Campaigns Targeting Global Policy Organizatio

    www.microsoft.com · 14d ago · September 29th, 2026

15. update from cyberscoop.com

    Russian hackers Star Blizzard expand targeting, change up tactics to reach Ukraine and beyond

    cyberscoop.com · 14d ago · September 29th, 2026

    A group of Russian government hackers is refining its attacks to make it easier to eavesdrop on victims and significantly expand its targets among governments, think tanks and nonprofits around the world, with an emphasis on Ukraine, Microsoft research published Tuesday concludes. The company examined a change in the approach of a group it calls Star Blizzard, which is affiliated with the Russian Federal Security Service (FSB), and its novel malware, RedFlick. “The larger-scale phishing operations were observed at a scale not previously seen from the actor, ranging from tens to hundreds of email messages per campaign. One of the things that makes RedFlick effective isn’t just its pure volume, but the fact that its “infection flow only requires a single user interaction, reducing friction in the compromise proce

16. mentioned by www.microsoft.com

    Since January 2026, Microsoft has observed Russian state threat actor Star Blizzard (FSB Center 18) evolve their detection evasion capabilit

    www.microsoft.com · 14d ago · September 29th, 2026

17. update from fawkes.rocks

    Star Blizzard scales up phishing against Ukraine backers https:// fawkes.rocks/2026/09/30/star-b lizzard-scales-up-phishing-against-ukraine-

    fawkes.rocks · 13d ago · September 30th, 2026

    Star Blizzard scales up phishing against Ukraine backers https:// fawkes.rocks/2026/09/30/star-b lizzard-scales-up-phishing-against-ukraine-

    via Mastodon https://fawkes.rocks/2026/09/30/star-blizzard-scales-up-phishing-against-ukraine-backers/

18. mentioned by cyberworldops.eu

    Star Blizzard shifted to a RedFlick infection chain across 12+ campaigns from January to August 2026. The FSB Centre 18-linked activity targ

    cyberworldops.eu · 13d ago · September 30th, 2026

19. update from securityonline.info

    Star Blizzard RedFlick phishing hit 100+ groups that back Ukraine, using scheduled tasks to drop the CosmicPulse backdoor after a single cli

    securityonline.info · 13d ago · September 30th, 2026

    Star Blizzard RedFlick phishing hit 100+ groups that back Ukraine, using scheduled tasks to drop the CosmicPulse backdoor after a single cli

    via Mastodon https://securityonline.info/star-blizzard-redflick/?utm_source=mastodon&utm_medium=jetpack_social

20. update from gbhackers.com

    RedFlick Uses Scheduled Tasks and Password-Protected Archives to Deploy CosmicPulse Backdoor

    gbhackers.com · 13d ago · September 30th, 2026

    The activity […] The post RedFlick Uses Scheduled Tasks and Password-Protected Archives to Deploy CosmicPulse Backdoor appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform .

21. update from dev.to

    Star Blizzard Hits 100+ Organizations With Fake Event Invites Delivering CosmicPulse Backdoor # cybersecurity # infosec # security # softwar

    dev.to · 13d ago · September 30th, 2026

    Star Blizzard Hits 100+ Organizations With Fake Event Invites Delivering CosmicPulse Backdoor # cybersecurity # infosec # security # softwar

    via Mastodon https://dev.to/etairos/star-blizzard-hits-100-organizations-with-fake-event-invites-delivering-cosmicpulse-backdoor-3aeo

22. mentioned by deafnews.it

    Star Blizzard replaces ClickFix with RedFlick, a single-click infection chain. Since January, 13 mass campaigns have targeted over 100 organ

    deafnews.it · 13d ago · September 30th, 2026

23. update from bleepingcomputer.com

    Russian state hackers use new RedFlick technique to push malware

    bleepingcomputer.com · 13d ago · September 30th, 2026

    Although the tactic is not a new cybersecurity technique, it is a new delivery approach for the threat actor, allowing it to further automate attacks and reduce victim interaction. Star Blizzard, active since 2017 , is known for exploring new payload delivery avenues like ClickFix or WhatsApp , and for continually developing and deploying new malware families . The archive contains a VHDX virtual disk with an LNK file disguised as a PDF. When the file is opened, it launches a command in a hidden window while displaying a decoy PDF to the victim. VHDX-based attack chain Source: Microsoft The commands download and run an MSI installer that creates three scheduled tasks posing as legitimate maintenance components, each with a specific purpose: Internet Quality Test Connection: sends the computer/network name and username to the attackers and can execute a remote DLL. Network Configuration Manager: prepares Windows’ WebDAV functionality so remote web resources can be accessed through file-style paths. System Health Monitor: uses control.exe to

24. mentioned by www.bleepingcomputer.com

    Russian state-sponsored hackers use a new technique called RedFlick to distribute malware

    www.bleepingcomputer.com · 13d ago · September 30th, 2026

25. mentioned by www.bleepingcomputer.com

    Russian state hackers use new RedFlick technique to push malware The Russian state actor Star Blizzard has been using a new malware installa

    www.bleepingcomputer.com · 13d ago · October 1st, 2026

26. mentioned by www.bleepingcomputer.com

    Star Blizzard Uses New RedFlick Technique to Deploy CosmicPulse https:// bleepingcomputer.com/news/security/ russian-state-hackers-use-new-r

    www.bleepingcomputer.com · 12d ago · October 1st, 2026

27. mentioned by www.bleepingcomputer.com

    Russian state hackers use new # RedFlick technique to push # malware https://www. bleepingcomputer.com/news/secu rity/russian-state-hackers-

    www.bleepingcomputer.com · 11d ago · October 2nd, 2026

28. mentioned by www.microsoft.com

    https://www. microsoft.com/en-us/security/b log/2026/09/29/star-blizzard-refines-phishing-and-malware-delivery-with-the-redflick-technique #

    www.microsoft.com · 11d ago · October 2nd, 2026