CosmicPulse
Python backdoor that Microsoft attributes to the FSB-linked group Star Blizzard.
Microsoft named CosmicPulse on 29 September 2026 as the backdoor behind at least 13 Star Blizzard phishing campaigns run between January and August, against over 100 mostly American and British organisations.
Last refreshed: 12 October 2026 · Appears in 1 active topic
Why did replying to a think-tank invitation install a Russian backdoor?
Timeline for CosmicPulse
Star Blizzard lures think tanks by invite
Cybersecurity: Threats and DefencesBackground
CosmicPulse, also called YESROBOT, is a backdoor written in Python. Microsoft named it on 29 September 2026 as the payload in at least 13 phishing campaigns between January and August 2026 that it attributes to Star Blizzard. Its targets numbered over 100 organisations, chiefly American and British think tanks, NGOs, diplomats and academics, plus Ukrainian civil society groups. Microsoft gives no infection count.
Microsoft says CosmicPulse reaches victims through a delivery method it calls RedFlick. Most lures were event invitations styled as coming from bodies such as the IISS, Chatham House and the Atlantic Council; one used Chatham House's London Conference in June as bait. A password-protected archive followed only after the target replied, so attachment scanning had nothing to inspect on first contact. Microsoft advises phishing-resistant MFA and checking unexpected senders through known contact details.
CISA places Star Blizzard under Centre 18 of Russia's FSB, a different unit from the Centre 16 that 19 agencies named over router hijacking in July. The NCSC and the Dutch AIVD had named Star Blizzard in March among state actors targeting messaging accounts.