The Russian state-linked hacking group Star Blizzard has sharply expanded its phishing operations in 2026, running more than 13 campaigns against over 100 organisations, mostly in the UK and US, according to Microsoft reporting covered by The Record on October 1.

The group, linked to Russia’s FSB security service, has adopted a technique dubbed “RedFlick”. Victims receive a password-protected archive and need only a single interaction to trigger the attack. It installs a backdoor called CosmicPulse through Windows scheduled tasks, giving the attackers persistent access.

Star Blizzard has long targeted government officials, journalists, academics and defence researchers to steal credentials and intelligence. The new technique lowers the bar for success, since it needs just one click rather than a chain of actions.

Security agencies advise enabling multi-factor authentication, treating unexpected archives with suspicion, and keeping systems patched. The campaign is a reminder that state-backed phishing remains one of the most effective cyber threats facing public institutions.