Microsoft Exposes Russian Hackers’ New Cyberattack Techniques
Microsoft says a Russian state-linked hacking group has developed new phishing and malware-delivery techniques to evade detection and target organisations around the world.
Microsoft has exposed a new campaign by Star Blizzard, a Russian state-linked threat actor that the company says has been refining its cyber-espionage operations since January 2026. Microsoft Threat Intelligence reported that the group has expanded its use of large-scale phishing campaigns, compromised websites and a new malware-delivery technique known as RedFlick. The activity has targeted Ukrainian individuals and institutions as well as governments, think tanks, non-governmental organisations and other groups involved in international policy.
According to Microsoft, RedFlick represents a change from Star Blizzard’s earlier infection methods. The technique uses scheduled tasks to deliver the group’s CosmicPulse backdoor, helping the attackers avoid detection. Microsoft said the change demonstrates how the group continues to modify its methods as cybersecurity companies improve their ability to identify and block previous attack techniques.
Star Blizzard is assessed by Microsoft as a Russia-based threat actor involved primarily in cyber-espionage. The group has historically focused on governments, diplomatic organisations, NGOs, Western think tanks and technology-related organisations. Microsoft says the group’s objectives are generally linked to intelligence collection and support for Russian foreign-policy interests.
The disclosure comes amid a broader increase in Russian-linked cyber activity targeting organisations and cloud environments. Microsoft previously reported that another Russia-linked cluster, Storm-2945, had been conducting targeted attacks involving compromised networks and phishing campaigns. The company also said that artificial intelligence was being used to support a significant portion of those operations, showing how AI is increasingly becoming part of the wider cybersecurity threat landscape.
Microsoft has published information about the campaign to help organisations recognise and defend against the activity. The company recommends strengthening security monitoring, investigating suspicious authentication and network activity, and using available security detections to identify related threats. The latest findings underline the continuing evolution of state-linked cyber-espionage campaigns and the need for organisations to regularly update their defensive measures as attackers change their techniques.
