RedFlick phishing campaigns linked to the Russian state actor Star Blizzard have affected more than 100 organizations, primarily in the United States and United Kingdom, Microsoft Threat Intelligence reported on September 29. The operations target Ukrainian institutions and people, governments, financial organizations and policy groups connected to support for Ukraine. Microsoft said the actor expanded its email campaigns and adopted a delivery method that can install a backdoor after one user interaction.

Microsoft said Star Blizzard, also known as SEABORGIUM, has run at least 13 large-scale phishing campaigns since January 2026. Early campaigns used purported tax and fine notices against targets in Ukraine; later ones expanded internationally with invitations to policy events. CyberScoop reported that the approach reaches more potential victims than the actor’s earlier, narrowly targeted operations. Microsoft cited CISA’s attribution of the group to Russia’s Federal Security Service.

According to Microsoft, an initial email often has no attachment. If a recipient replies, the attacker sends a password-protected RAR or ZIP archive containing files that start the RedFlick chain. Microsoft also found email accounts created on compromised WordPress and cPanel websites. The sender name could resemble a trusted contact while the actual domain belonged to another organization.

Microsoft traced a variant using a virtual hard disk with a Windows shortcut disguised as a PDF. Opening it launched a script that fetched a malicious installer. A later variant used a shortcut to download a PDF concealing an encoded PowerShell command, which retrieved an installer. RedFlick scheduled tasks help deploy CosmicPulse, a Python backdoor; some tasks beacon host details or retrieve attacker-controlled payloads. Microsoft published indicators and hunting queries.

Microsoft said the activity affected over 100 organizations, but did not state that every target was compromised. It said it directly notifies customers identified as targeted or compromised. Its guidance calls for phishing-resistant authentication, email link and attachment screening, and endpoint detection in block mode. The report lists detections for suspicious shortcuts, installer behavior, RedFlick tasks and CosmicPulse.

Government agencies, think tanks, nonprofits and financial institutions involved with Ukraine policy can use Microsoft’s indicators to review mail and endpoint activity. Microsoft advises checking a sender’s actual domain and confirming unexpected invitations through a known contact channel. Its research documents broader distribution and fewer steps needed to run the payload, but gives no total for successful intrusions.