Russian FSB-linked hackers scale up phishing attacks against Ukraine supporters

Microsoft reports that the Russian state-backed group Star Blizzard (Callisto/ColdRiver) has expanded in 2026 from targeted spear-phishing to large-scale mass-mailing campaigns, using compromised website accounts and a new delivery method called RedFlick to install the CosmicPulse backdoor via password-protected archives and scheduled tasks, impacting more than 100 organizations across the U.S., UK and other international targets.