Russia's Star Blizzard Targets 100+ Organizations With Fake Event Invites to Deliver Backdoor
Summary: Russian state hackers tracked as Star Blizzard, which U.S., U.K., Australian, Canadian and New Zealand agencies said in December 2023 almost certainly works under Center 18 of Russia's FSB, have used fake event invitations to deliver a Windows backdoor to people and organizations tied to Ukraine, affecting more than 100 organizations since January, mostly in the U.S. and U.K. Microsoft counted at least 13 larger campaigns this year, each with tens to hundreds of emails, and said the group switched this year to a method it calls RedFlick, which uses Windows scheduled tasks to install a Python-based backdoor named CosmicPulse.
Why it matters: More than 100 organizations have been affected since January, and Microsoft says one domain used in the campaigns, secure-dns-hub[.]com, was still live when it published its report on September 29 - so the infrastructure behind these invitations was still running as the warning went out.
Read the original at The Hacker News ↗
- Topics
- Malware
- Related
- ARTEX and beyond: AI-enabled penetration testing platforms Cyber Risks · Nov 13, 2026Fake GTA 6 download goes after Steam logins and crypto wallet data Cyber Risks · Nov 13, 2026Operation Endgame Takes Down Gootloader, CastleRAT and StealC Servers, Seizes 6.4M Stolen Logins Cyber Risks · Nov 13, 2026