Star Blizzard

At a glance

Facts

• Russian state-sponsored group known for cyber espionage

Activity timeline

Facts

• Campaigns targeting 100+ organizations since January 2026
• At least 13 larger campaigns in 2026, each with tens to hundreds of emails
• Long history of stealing email passwords by posing as known contacts
• By 2023 had used fake conference and event invitations as bait
• March campaign targeted iPhone users with DarkSword exploit kit

Attribution assessment

Facts

• Assessed to work under Center 18 of Russia's Federal Security Service (FSB) according to security agencies in the U.S., U.K., Australia, Canada and New Zealand (as of December 2023)

Initial access and identity targets

Facts

• Fake event invitations posing as well-known think tanks and NGOs (Chatham House, Atlantic Council)
• Emails appearing to originate from within target organizations
• Fake Ukrainian authority notices (tax audits, fines, water shutdown notices)
• Password-protected archives with passwords shown in images
• Fake CAPTCHA pages (ClickFix method, used in 2025)
• Links to iPhone exploit kits

Capabilities and evasion

Facts

• Delivers Windows backdoors through LNK files disguised as PDFs
• Uses Windows Installer (MSI) packages to set up scheduled tasks
• Creates scheduled tasks with legitimate-appearing names to establish persistence
• Installs Python-based backdoor (CosmicPulse)
• Uses SSH to download malware installers
• Uses WebDAV for command execution
• Employs Control Panel (control.exe) for staged execution
• Can extract computer names and usernames to C2 server
• Deploys iPhone exploits targeting 6 vulnerabilities patched in iOS 26.3

Infrastructure patterns

Facts

• Uses hacked WordPress and cPanel websites for email accounts (since March 2026)
• Previously used free email services (Proton and Microsoft consumer accounts)
• Command-and-control servers that send malware installers and execute remote commands
• Uses domain secure-dns-hub.com

Communication and pressure channels

Facts

• Often exchanges messages with targets before sending malicious links
• Uses password phishing with Evilginx to steal credentials and session cookies

Observed targeting

Facts

• Focuses on people and organizations tied to Ukraine
• Targets think tanks and NGOs involved in Ukraine policy
• Targets international financial organizations
• Targets Ukrainian civil society organizations
• Targets government bodies and policy experts

Named victims

Organizations

• 100+ organizations (primarily in the U.S. and U.K.)
• people and organizations tied to Ukraine
• Ukrainian email service Ukr.net users
• staff at an international financial organization
• Ukrainian civil society organizations

Defender guidance

Facts

• Verify sender addresses by contacting known phone numbers or email addresses
• Search for scheduled task names: Internet Quality Test Connection, Network Configuration Manager, System Health Monitor
• Search for Microsoft Defender detections: Trojan:Script/RedFlick and Backdoor:Python/CosmicPulse
• Use Microsoft Sentinel for logs extending beyond 30-day retention
• Block or limit outbound SSH connections not required by business
• Enable attack surface reduction rules blocking rare/new/untrusted executables and obfuscated scripts
• Use phishing-resistant sign-in methods
• Update iPhones to iOS 26.3 or later and enable Lockdown Mode where unavailable

Reported detail

Facts

• Star Blizzard, a Russian state-sponsored group affiliated with the FSB, has conducted multiple campaigns since January 2026 targeting 100+ organizations primarily in the U.S. and U.K., with a focus on people and organizations connected to Ukraine.
• The group uses fake event invitations posing as legitimate organizations to deliver Windows backdoors through LNK files and MSI packages that establish persistence via scheduled tasks.
• The malware delivery has evolved through multiple methods including ClickFix fake CAPTCHA pages in 2025 and the RedFlick method in 2026, ultimately installing the CosmicPulse Python-based backdoor.
• Star Blizzard leverages stolen email accounts on hacked WordPress and cPanel sites, along with password phishing using Evilginx, to compromise targets and maintain access.
• The group also targets iPhone users through DarkSword exploit kits, using vulnerabilities patched in iOS 26.3.