A Russian espionage group tied to the FSB has shifted from carefully targeted phishing to high-volume campaigns, reaching more than 100 organizations this year, mainly in the United States and United Kingdom, CyberScoop reported Tuesday, citing new Microsoft research. The group, which Microsoft tracks as Star Blizzard, is also using a new infection technique that needs only one click from a victim.

What Happened

Microsoft said Star Blizzard, also known as SEABORGIUM, Callisto, TA446 and COLDRIVER, has run 13 distinct large-scale phishing campaigns since January 2026 against NGOs, think tanks, government bodies and financial institutions. Each campaign involved tens to hundreds of emails, which Microsoft attributed to the group's adoption of a mass-mailing platform to automate its operations.

Activity early in the year focused on Ukraine. Microsoft said January and February campaigns went after users of the Ukr.net email service with fake tax audits and fines, and The Hacker News reported other lures such as water shutdown notices sent to hotels in Kyiv. From March, the targeting widened internationally, with emails impersonating organizations such as Chatham House, the Atlantic Council and the International Institute for Strategic Studies and inviting recipients to closed-door discussions on European security and Ukraine.

RelatedU.S. Seizes Integrity Tech Hacking Tool Sites as Seven Nations Detail Flax Typhoon Ops

The new technique, which Microsoft calls RedFlick, starts with an email carrying no attachment. A follow-up sends a password-protected archive containing a Windows shortcut file dressed up as a PDF. Opening it runs commands that download a Windows Installer package, which creates three scheduled tasks with names made to look like legitimate system components, including "Network Configuration Manager" and "System Health Monitor." Those tasks deploy CosmicPulse, a Python-based backdoor also tracked as NOROBOT or BAITSWITCH, for persistent access.

Around March the group also stopped sending from free email services and began using accounts on compromised WordPress and cPanel-hosted websites. One March campaign built around Atlantic Council invitations delivered the DarkSword iPhone exploit kit, rather than the Windows backdoor, to people who replied, The Hacker News reported.

Why It Matters

Star Blizzard has for years been known for patient, personalized credential phishing of policy experts, officials and journalists. Moving to volume increases the number of organizations exposed and suggests the group is willing to trade some stealth for reach. The single-click RedFlick chain also lowers the bar for a successful compromise compared with its earlier methods.

The targets are the same kinds of groups that shape Western policy on Russia and Ukraine. Microsoft said organizations involved in supporting Ukraine face elevated risk and that it has notified compromised customers directly.

What Microsoft Recommends

Microsoft advised blocking outbound SSH connections that are not needed for business, enabling attack surface reduction rules to restrict executable content, turning on network protection, and using phishing-resistant authentication with Conditional Access. For iPhones, The Hacker News quoted guidance to update to iOS 26.3 or later, which fixes the flaws DarkSword uses, and to use Lockdown Mode where updating is not yet possible.

What to Watch

Microsoft published hunting queries and indicators of compromise, and The Hacker News reported that at least one domain linked to the campaigns was still live when the research was released. Microsoft and the Justice Department previously seized more than 100 of the group's domains, and further takedowns would be a sign of continued pressure on its infrastructure.