Russia's Star Blizzard Targets 100+ Organizations With Fake Event Invites to Deliver Backdoor

Russia's FSB-linked threat group Star Blizzard is conducting highly targeted phishing campaigns using convincing fake event invitations — many themed around Ukrainian affairs — to manipulate victims into installing the CosmicPulse backdoor on Windows systems. The root cause is insufficient security awareness and email hygiene, compounded by the group's use of legitimate compromised infrastructure (WordPress and cPanel accounts) to bypass reputation-based defenses. This matters because state-sponsored actors with persistent access can exfiltrate sensitive data, conduct long-term espionage, and pivot deeper into organizational networks. The evolving RedFlick infection chain demonstrates that these adversaries actively adapt their TTPs to evade detection, making static defenses inadequate.