Star Blizzard Targets 100+ Organizations with Phishing and RedFlick Technique

Microsoft Threat Intelligence reports that Star Blizzard (also known as Callisto/SEABORGIUM), a Russian state-linked threat actor, has conducted at least 13 large-scale phishing campaigns since January 2026 targeting over 100 organizations (primarily in the US and UK) and Ukrainian entities. The actor has shifted to lower-interaction malware delivery—using compromised WordPress/cPanel accounts, VHDX files with disguised LNKs, MSI installers, SSH.exe and scheduled tasks (RedFlick) to deploy the CosmicPulse/NOROBOT/YESROBOT backdoor—while leveraging scheduled tasks for persistence; Microsoft recommends phishing-resistant authentication, EDR block mode, and enhanced email/endpoint controls.