A Russian government-backed hacking group, identified by Microsoft as Star Blizzard and affiliated with the Federal Security Service (FSB), has significantly expanded its targeting and refined its attack methods. The group, also known as SEABORGIUM, Callisto Group, TA446, and COLDRIVER, has shifted from highly targeted spear-phishing to larger-scale phishing campaigns, impacting over 100 organizations primarily in the United States and United Kingdom.
Microsoft's research, published in late September 2026, details the group's adoption of a mass-mailing phishing platform to automate campaign execution. This change has led to campaigns ranging from tens to hundreds of email messages, a scale not previously observed from Star Blizzard. The primary goal of these operations is to facilitate eavesdropping on victims.
The group's new malware, RedFlick, is a key component of these campaigns. RedFlick's effectiveness stems from its low-friction infection flow, requiring only a single user interaction to initiate a set of scheduled tasks that deploy the custom backdoor, CosmicPulse. This technique helps evade detection.
Initially, Star Blizzard's RedFlick campaigns focused on Ukrainian targets, including financial institutions and governments supporting Ukraine. However, since January 2026, Microsoft has observed at least 13 distinct large-scale phishing campaigns that expanded to target NGOs, think tanks, and government organizations worldwide. By spring 2026, the targeting had moved beyond Ukraine, suggesting the initial focus on Ukraine may have served as a testing ground for their new capabilities.
Common phishing lures include invitations to exclusive events, as well as notifications about tax audits, payment notices, and fines. The shift to higher volume attacks and broader targeting marks an evolution in Star Blizzard's tactics, which Microsoft has been tracking since at least 2023, with previous observations in 2025 and takedown efforts in 2024.
