[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fNnwAvHeHRZ_KeODj9IG-M_MhZfEjovqf20cG-NnCpKk":3},{"article":4,"iocs":46,"watch_terms":64,"solutions":65,"lesson":151},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":28,"category":29,"article_tags":33},"9ace1118-b420-47de-b732-f19ca96cdeb6","Russia's Star Blizzard Targets 100+ Organizations With Fake Event Invites to Deliver Backdoor","russia-s-star-blizzard-targets-100-organizations-with-fake-event-invites-to-deli-ca7def","Russian state hackers known as Star Blizzard have been using fake event invitations to trick people into installing a backdoor on their Windows computers, according to Microsoft. The campaigns, aimed at people and organizations tied to Ukraine, have affected more than 100 organizations since January, mostly in the U.S. and U.K. At least one computer was infected, but the number of breached","Russian state-sponsored threat group Star Blizzard has targeted over 100 organizations since January with sophisticated phishing campaigns. The group, believed to be linked to Russia's FSB, uses fake event invitations and lures related to Ukrainian affairs to trick victims into installing a backdoor malware named CosmicPulse on Windows systems. Microsoft has observed evolving tactics, including the use of compromised WordPress and cPanel accounts for hosting malicious content and a new infection chain called RedFlick.","Russian state hackers Star Blizzard use fake event invites to deliver CosmicPulse backdoor.","https:\u002F\u002Fthehackernews.com\u002F2026\u002F09\u002Frussias-star-blizzard-targets-100.html","https:\u002F\u002Fblogger.googleusercontent.com\u002Fimg\u002Fb\u002FR29vZ2xl\u002FAVvXsEhQDuuJUT-WU7XzUYYoKEDtFKt7QAra8I4G0ptQRyveku8G6fD6R0aSWw32hi-2fd0L28qUxjqJoTlQoJbLiBYH6NBOVYirQZ9LfH-UvD8JG5uiL_m4ZkBVnPLiArcivCsdMNegW1XGxFEzas4cwkzFVeY4r22qTqSp2U1Fo3Nw7urOlnWRKGFHW8pW91E\u002Fs1600\u002Fms-invite.jpg","2026-09-29T17:20:08+00:00","2026-09-29T20:01:06.295292+00:00",9,[17,20,23,26],{"name":18,"type":19},"Star Blizzard","threat_actor",{"name":21,"type":22},"Microsoft","vendor",{"name":24,"type":25},"CosmicPulse","product",{"name":27,"type":25},"DarkSword","6cbdd207-aaa1-4176-9534-e156b125e917",{"id":28,"icon":30,"name":31,"slug":32},null,"Nation-state","nation-state",[34,36,41],{"category":35},{"id":28,"icon":30,"name":31,"slug":32},{"category":37},{"id":38,"icon":30,"name":39,"slug":40},"89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5","Malware","malware",{"category":42},{"id":43,"icon":30,"name":44,"slug":45},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[47,49,51,55,58,61],{"type":40,"value":24,"context":48},"Backdoor malware delivered by Star Blizzard.",{"type":40,"value":27,"context":50},"iPhone exploit kit potentially used in one campaign.",{"type":52,"value":53,"context":54},"mitre_attack","T1059.003","Windows Command Shell (used in infection chain).",{"type":52,"value":56,"context":57},"T1547.001","Registry Run Keys \u002F Startup Folder (implied by scheduled tasks).",{"type":52,"value":59,"context":60},"T1071.001","Web Protocols (WebDAV used in infection chain).",{"type":52,"value":62,"context":63},"T1105","Ingress Tool Transfer (downloading installer from C2).",[21,24,27],{"controls":66,"vendors":147},[67,95,121],{"slug":68,"name":69,"problem":70,"products":71},"phishing-resistant-mfa","Phishing-resistant MFA","A stolen password, or a user who taps Approve on a push prompt, is no longer enough to log in.",[72,79,87],{"vendor_slug":73,"vendor_name":21,"vendor_logo":74,"product_slug":75,"product_name":76,"url":77,"description":78},"microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","entra-id","Microsoft Entra ID","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fidentity-access\u002Fmicrosoft-entra-id","Cloud identity and access management with single sign-on, conditional access, passkeys and identity governance.",{"vendor_slug":80,"vendor_name":81,"vendor_logo":82,"product_slug":83,"product_name":84,"url":85,"description":86},"yubico","Yubico","\u002Fvendor-logos\u002Fyubico.png","yubikey","YubiKey","https:\u002F\u002Fwww.yubico.com\u002Fproducts\u002F","Hardware security keys for FIDO2, passkeys and smart card login, in USB and NFC versions.",{"vendor_slug":88,"vendor_name":89,"vendor_logo":90,"product_slug":91,"product_name":92,"url":93,"description":94},"okta","Okta","\u002Fvendor-logos\u002Fokta.png","workforce-identity","Okta Workforce Identity","https:\u002F\u002Fwww.okta.com\u002Fproducts\u002Fworkforce-identity\u002F","Single sign-on, adaptive MFA including phishing-resistant methods, and lifecycle management for employees.",{"slug":96,"name":97,"problem":98,"products":99},"email-security","Email security","Phishing, malware and invoice fraud are filtered out before they reach inboxes.",[100,108,116],{"vendor_slug":101,"vendor_name":102,"vendor_logo":103,"product_slug":104,"product_name":105,"url":106,"description":107},"abnormal","Abnormal AI","\u002Fvendor-logos\u002Fabnormal.png","abnormal-email-security","Abnormal Inbound Email Security","https:\u002F\u002Fabnormal.ai\u002F","API-based email security for Microsoft 365 and Google Workspace using behavioural models.",{"vendor_slug":109,"vendor_name":110,"vendor_logo":111,"product_slug":112,"product_name":113,"url":114,"description":115},"darktrace","Darktrace","\u002Fvendor-logos\u002Fdarktrace.png","darktrace-email","Darktrace \u002F EMAIL","https:\u002F\u002Fwww.darktrace.com\u002Fproducts\u002Femail","Email security that flags messages deviating from normal communication patterns.",{"vendor_slug":73,"vendor_name":21,"vendor_logo":74,"product_slug":117,"product_name":118,"url":119,"description":120},"defender-for-office-365","Microsoft Defender for Office 365","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fsiem-and-xdr\u002Fmicrosoft-defender-office-365","Protection for Exchange Online, Teams and SharePoint against phishing, malicious links and attachments.",{"slug":122,"name":123,"problem":124,"products":125},"security-awareness-training","Security awareness training and phishing simulation","People recognise and report attacks instead of falling for them.",[126,134,140],{"vendor_slug":127,"vendor_name":128,"vendor_logo":129,"product_slug":130,"product_name":131,"url":132,"description":133},"huntress","Huntress","\u002Fvendor-logos\u002Fhuntress.png","managed-sat","Huntress Managed Security Awareness Training","https:\u002F\u002Fwww.huntress.com\u002Fplatform\u002Fsecurity-awareness-training","Security awareness training and phishing simulation, managed for you.",{"vendor_slug":135,"vendor_name":136,"vendor_logo":137,"product_slug":135,"product_name":136,"url":138,"description":139},"hoxhunt","Hoxhunt","\u002Fvendor-logos\u002Fhoxhunt.png","https:\u002F\u002Fhoxhunt.com\u002F","Adaptive phishing simulations and micro-training, with a focus on reporting.",{"vendor_slug":141,"vendor_name":142,"vendor_logo":143,"product_slug":141,"product_name":144,"url":145,"description":146},"sosafe","SoSafe","\u002Fvendor-logos\u002Fsosafe.png","SoSafe Awareness Platform","https:\u002F\u002Fsosafe-awareness.com\u002F","Behaviour-based awareness training and phishing simulation in many languages.",[148],{"slug":73,"name":21,"logo_path":74,"roles":149},[150],"reported_by",{"slug":152,"title":153,"body":154,"framework_refs":155,"framework_notes":166},"star-blizzard-uses-fake-event-invites-to-deploy-backdoor-across-100-orgs","Star Blizzard Uses Fake Event Invites to Deploy Backdoor Across 100+ Orgs","Russia's FSB-linked threat group Star Blizzard is conducting highly targeted phishing campaigns using convincing fake event invitations — many themed around Ukrainian affairs — to manipulate victims into installing the CosmicPulse backdoor on Windows systems. The root cause is insufficient security awareness and email hygiene, compounded by the group's use of legitimate compromised infrastructure (WordPress and cPanel accounts) to bypass reputation-based defenses. This matters because state-sponsored actors with persistent access can exfiltrate sensitive data, conduct long-term espionage, and pivot deeper into organizational networks. The evolving RedFlick infection chain demonstrates that these adversaries actively adapt their TTPs to evade detection, making static defenses inadequate.",[156,157,158,159,160,161,162,163,164,165],"CIS Control 9 – Email and Web Browser Protections","CIS Control 14 – Security Awareness and Skills Training","CIS Control 17 – Incident Response Management","NIST SP 800-53 SI-3 – Malicious Code Protection","NIST SP 800-53 AT-2 – Literacy Training and Awareness","NIST SP 800-53 IA-5 – Authenticator Management (MFA)","NIST SP 800-53 AU-6 – Audit Record Review, Analysis, and Reporting","MITRE ATT&CK T1566.001 – Phishing: Spearphishing Attachment","MITRE ATT&CK T1078 – Valid Accounts (compromised infrastructure)","CISA Advisory AA23-347A – Russian FSB Cyber Actor Star Blizzard",{}]