Star Blizzard now sends its Ukraine lures from hacked WordPress and cPanel sites
Microsoft says Star Blizzard has sent fake event invitations to more than 100 organizations since January, many from hacked WordPress and cPanel sites. The group, long known for stealing email passwords, now uses the messages to install a Windows backdoor.
The Watch · Security desk
What happened
- Security agencies in the US, UK, Australia, Canada and New Zealand said in December 2023 that the group almost certainly works under Center 18 of Russia's FSB.
- Microsoft counted at least 13 larger campaigns this year, each running tens to hundreds of emails, on top of the group's routine targeted phishing.
- Early lures posed as Ukrainian authorities with fake tax audit and fine notices for Ukr.net users, and later ones included a water shutdown notice for Kyiv hotels.
- At least one computer is confirmed infected, but the number of breached organizations has not been disclosed.
Why it matters
- Who's exposed exposure Staff at Ukraine-linked think tanks and NGOs now get these lures from real websites' mail accounts, so blocking or down-scoring free-mail senders catches less of this group's traffic.
- What it limits constraint Gateway checks on the first message have nothing malicious to inspect, so the outcome turns on whether a staff member answers an unexpected invitation.
- What's now possible capability Endpoint teams can hunt for the task names, for control.exe pulling a stage from a remote server, and for the shared IP and domain, whether or not the mail was caught.
- What doesn't add up contradiction Microsoft ties a March Atlantic Council wave to the DarkSword iPhone kit, but Trellix gives that link only medium confidence, so the iPhone risk from this group is less well established than the Windows chain.
Next story · Leadership · 2d ago
Microsoft's October release of 1,407 CVEs tops 2020's full-year record by 146Confirmed23 publishers
Until March, Star Blizzard mostly sent its phishing from free services such as Proton and Microsoft consumer accounts [5]. Since then its larger campaigns have come from mail accounts on WordPress and cPanel websites. Microsoft is highly confident the group hacked those sites for that purpose [4]. Many messages are also written to look as if they came from inside the target's own organization, with invitations naming hosts such as Chatham House and the Atlantic Council [7]. A free-mail address sending a think-tank invitation is easy to flag. A message from an existing website's own mail server gives a filter that weighs sender reputation less to go on. The reported findings do not say how many of the messages were delivered.
The first email usually has no attachment [8]. A reply brings a password-protected RAR or ZIP archive, with the password shown in an image [8]. The conversation step is older. By 2023 the group was already using conference invitations as bait and often exchanged messages with a target before sending a malicious link [12].
What follows the reply has changed from year to year. In 2025 the group used ClickFix, fake CAPTCHA pages that got targets to run commands themselves. This year it switched to a method Microsoft calls RedFlick, built on Windows scheduled tasks [3]. Every version Microsoft traced starts with a shortcut file disguised as a PDF, and a Windows Installer package sets up the tasks [16]. The download step varies. In January a hidden script used SSH; in July the shortcut fetched a PDF carrying a hidden command [16].
The April installer created three tasks named Internet Quality Test Connection, Network Configuration Manager and System Health Monitor [17]. The first sends the computer and user name to the command server and can run remote code. The second sets up WebDAV. The third uses control.exe to run the next stage from the command server [17]. That stage is a downloader disguised as a Control Panel item, and it installs the Python-based backdoor CosmicPulse [18]. Earlier reports called the same downloader NOROBOT or BAITSWITCH [18].
Infection takes several deliberate steps. The target replies, opens an archive with a password read off an image, and runs a shortcut [8][16]. The campaigns are aimed at people and organizations tied to Ukraine, mostly in the US and UK [1]. Outside that group, this is a low priority. Inside it, the larger waves alone come to at least 130 messages this year [22]. Proofpoint reported a sharp rise in the group's email volume in March [13].
Microsoft says the techniques overlap with a June campaign against Ukrainian civil society groups that used fake Ukraine Recovery Conference invitations [19]. Digital Security Lab Ukraine, which reported that campaign, did not name the attackers and could not recover the final payload [19]. A comparison by The Hacker News found the IP address 103.160.59[.]97 and the domain secure-dns-hub[.]com in both Microsoft's indicator list and the June report [20]. Shared indicators do not by themselves show that one group ran both [20].
What to watch
- A disclosed count of breached organizations beyond the single confirmed infected computer.
- Recovery of DarkSword exploit code from the March Atlantic Council emails, which would settle Trellix's medium-confidence link.
- Further indicators or a final payload tying the June Ukraine Recovery Conference campaign to Star Blizzard.
Clarity's read
What the record supports and how the coverage leans. The claims behind it follow.
Reality
- Evidence66
- Adoption35
- Hype gap+18
- Incentives35
- Confidence70
Perspective Coverage
8 publishers- Builder
- Builder 28%
- Operator
- Operator 62%
- Investor
- Investor 10%
Claim ledger
Ranked by verification strength, evidence, and original report placement.
- [1]
The campaigns, aimed at people and organizations tied to Ukraine, have affected more than 100 organizations since January, mostly in the U.S. and U.K.
- [2]
Security agencies in the U.S., U.K., Australia, Canada and New Zealand said in December 2023 that Star Blizzard almost certainly works under Center 18 of Russia's Federal Security Service (FSB).
- [3]
In 2025 the group delivered malware through fake CAPTCHA pages that tricked targets into running commands themselves (ClickFix); this year it switched to a method Microsoft calls RedFlick, which uses Windows scheduled tasks to install a backdoor named CosmicPulse.
- [4]
Since March, the larger campaigns have used email accounts on WordPress and cPanel websites, which Microsoft is highly confident the group hacked for that purpose.
- [5]
Before March, the group mostly used free email services such as Proton and Microsoft consumer accounts.
- [6]
According to Microsoft, Russian state hackers known as Star Blizzard have been using fake event invitations to trick people into installing a backdoor on their Windows computers.
- [7]
The invitations name well-known think tanks or NGOs as hosts, such as Chatham House and the Atlantic Council; many emails are written to appear to come from within the target's organization.
- [8]
The first email usually carries no attachment; if the target replies, the group sends a password-protected RAR or ZIP archive, with the password shown in an image.
- [9]
The first campaigns, in January and February, posed as Ukrainian authorities and sent fake tax audit and fine notices to users of Ukr.net; later lures included a water shutdown notice for hotels in Kyiv and a payment notice for staff at an international financial organization.
- [10]
The group has long stolen email passwords by posing as people its targets know.
- [11]
In one March campaign, people who replied to an Atlantic Council-themed invitation got a link to DarkSword, an iPhone exploit kit, instead of the Windows backdoor, according to Microsoft.
- [12]
By 2023, the group had already used fake conference and event invitations as bait, often exchanging messages with a target before sending a malicious link.
- [13]
Proofpoint reported Atlantic Council-themed emails from the group in March, along with a sharp rise in its email volume.
- [14]
Microsoft counted at least 13 larger campaigns this year, each with tens to hundreds of emails, on top of the group's usual targeted phishing.
- [15]
Trellix found 4 Atlantic Council-themed emails sent on March 26; its confidence that the emails led to DarkSword is medium, because the exploit pages were offline and no exploit code was recovered.
- [16]
In all versions of the infection chain Microsoft traced, a shortcut (LNK) file disguised as a PDF initiates the attack and a Windows Installer (MSI) package sets up scheduled tasks; opening the shortcut runs commands that fetch the installer. In January a hidden script used SSH to download it; in July the shortcut downloaded a PDF with a hidden command that tries to fetch the installer.
- [17]
In the April version, the installer created three scheduled tasks named Internet Quality Test Connection, Network Configuration Manager and System Health Monitor. The first sends the computer name and user name to the C2 server and can run more code remotely; the second sets up WebDAV; the third uses control.exe to run the next stage from the C2 server.
- [18]
The next stage is a downloader disguised as a Control Panel item that installs CosmicPulse, a Python-based backdoor; the downloader is the one earlier reports called NOROBOT or BAITSWITCH.
- [19]
Microsoft says the techniques overlap with a June campaign, reported by Digital Security Lab Ukraine, that targeted Ukrainian civil society organizations with fake invitations to the Ukraine Recovery Conference; the lab did not name the attackers and could not recover the final payload.
- [20]
A comparison by The Hacker News found the IP address 103.160.59[.]97 and the domain secure-dns-hub[.]com in both Microsoft's list and the June report; sharing them does not by itself show that the same group ran both.
- [21]
At least one computer was infected, but the number of breached organizations has not been disclosed.
- [22]
At the lower bound of ten emails per campaign, Microsoft's 13 larger campaigns this year total at least 130 emails.
Sources
7 independent publishers whose own reporting we read for this story.
- bleepingcomputer.comRussian state hackers use new RedFlick technique to push malware
1 article · September 30, 2026
- cyberscoop.comRussian hackers Star Blizzard expand targeting, change up tactics to reach Ukraine and beyond | CyberScoop
2 articles · September 29, 2026
- darkreading.com
1 article · September 30, 2026
Russia's Star Blizzard Ditches ClickFix to Widen Phishing Net
- microsoft.comStar Blizzard refines phishing and malware delivery with the RedFlick technique
2 articles · September 29, 2026
- scworld.comRussian hacking group Star Blizzard expands phishing operations with new malware technique
1 article · October 1, 2026
- securityweek.comRussian APT Star Blizzard Uses ‘RedFlick’ Infection Chain in Recent Attacks
1 article · September 30, 2026
- thehackernews.comRussia's Star Blizzard Targets 100+ Organizations With Fake Event Invites to Deliver Backdoor
1 article · September 29, 2026
- therecord.mediaRussian FSB-linked hackers scale up phishing attacks against Ukraine supporters
1 article · September 30, 2026
Topics and entities
Topics
- Russian cyber operations against Ukraine
- State-sponsored phishing
- Windows malware persistence
Entities
- Atlantic Council
- Trellix
- Microsoft
- ClickFix
- Digital Security Lab Ukraine
- DarkSword
- Federal Security Service of Russia
- Proofpoint
- CISA