Russian hackers Star Blizzard expand targeting, change up tactics to reach Ukraine and beyond

Microsoft research found that Russian FSB-linked actor Star Blizzard has expanded in 2026 from targeted spear-phishing to large-scale mass-mailing phishing campaigns using a new malware delivery called RedFlick to deploy the CosmicPulse backdoor; the campaigns (at least 13 observed) primarily target NGOs, think tanks, governments and financial institutions—initially focused on Ukraine but later global—affecting over 100 organizations and leveraging single-interaction lures and scheduled tasks to evade detection.