CERT24Star Blizzard uses new RedFlick technique for phishing and CosmicPulse backdoor deliveryLoading data…
CERT24Threat Observatory
Period

Star Blizzard uses new RedFlick technique for phishing and CosmicPulse backdoor delivery

Since January 2026, Microsoft has observed Star Blizzard changing its tactics through large-scale phishing campaigns, accounts created on compromised websites, and the RedFlick technique for delivering CosmicPulse. The campaigns targeted Ukrainian individuals and institutions, as well as international NGOs, think tanks, governments, and other organizations associated with support for Ukraine. Microsoft observed the activity affecting more than 100 organizations, primarily in the United States and United Kingdom.

← Back to intelligence

Star Blizzard uses new RedFlick technique for phishing and CosmicPulse backdoor delivery

Since January 2026, Microsoft has observed Star Blizzard changing its tactics through large-scale phishing campaigns, accounts created on compromised websites, and the RedFlick technique for delivering CosmicPulse. The campaigns targeted Ukrainian individuals and institutions, as well as international NGOs, think tanks, governments, and other organizations associated with support for Ukraine. Microsoft observed the activity affecting more than 100 organizations, primarily in the United States and United Kingdom.