12OCT

Star Blizzard lures think tanks by invite

2 min read

10:55UTC

Microsoft tied at least 13 phishing campaigns this year to Star Blizzard, using fake event invitations from the IISS, Chatham House and the Atlantic Council.

← Back to China alert puts old bugs on a 3-day clock Jump to analysis ↓

TechnologyAssessed

Key takeaway

Star Blizzard's first email asks for an RSVP and carries nothing for scanners to inspect.

Microsoft attributed at least 13 phishing campaigns between January and August to Star Blizzard on 29 September⁠¹. CISA, Washington's cyber-defence agency, places the group under Centre 18 of Russia's Federal Security Service (FSB). More than 100 organisations were targeted, mainly in the US and UK, including think tanks, non-governmental organisations, diplomats, academics and Ukrainian civil society.

Most lures were invitations to events, styled as coming from the International Institute for Strategic Studies (IISS), Chatham House, the Atlantic Council and others. The June wave used Chatham House's London Conference and was aimed at parliamentarians among others. The first email carried no attachment and simply asked the target to confirm attendance.

Only after a reply did a password-protected archive follow, with the password shown as an image, so attachment scanning had nothing to inspect on first contact. Microsoft names the payload as CosmicPulse, a backdoor written in Python, and gives no infection count. Star Blizzard is a different FSB unit from Centre 16, which 19 agencies named over router hijacking in July.

Deep Analysis

In plain English

Star Blizzard is a hacking group that works for Russia's Federal Security Service (FSB), the country's main domestic intelligence agency. It tries to steal emails and documents from people who shape policy on Russia and Ukraine. Microsoft says the group sent fake invitations to conferences and round tables this year, pretending to be respected research bodies such as Chatham House in London. The first email was harmless and simply asked people to confirm they would attend. Only when someone replied did a second email arrive with a locked file. Opening it installed hidden software that gave the hackers access to the computer.

Deep Analysis

Root Causes

Think tanks, NGOs and university departments run small IT Teams, mix personal and work email, and depend on accepting invitations from strangers to do their jobs. Answering invitations from strangers is how a researcher fills a panel or wins a briefing, so the lure copies the daily job.

Impersonating IISS, Chatham House and the Atlantic Council works because their event invitations are routine and prized. A target who replies to confirm attendance has already granted the trust the second email relies on.

Delivery moved from ClickFix pages to VHDX disk images in January and to payloads hidden in PDFs in July. Each switch outpaces the detection rules built for the previous format.

What could happen next?

Risk
Researchers and officials who receive event invitations from IISS, Chatham House or the Atlantic Council face continued targeting, because the group has kept the method through two exposures.
Consequence
Impersonated institutions may move to verified invitation systems, which raises costs for small policy bodies.

Source Landscape

This story draws on neutral-leaning sources

Primary parallel: In December 2023 the UK named Star Blizzard as part of FSB Centre 18, sanctioned two officers, Ruslan Peretyatko and Andrey Korinets, and the US charged them over hack-and-leak operations against UK politicians. The exposure did not stop the lures; it put names to them.

Counter-parallel: No disruption has stuck. In October 2024 Microsoft and the US Justice Department seized more than 100 Star Blizzard domains, and by January 2025 Microsoft was reporting new WhatsApp-based lures from the same group.

Consensus view: Microsoft's account shows the reply-first design doing the work: an invitation with no attachment gives filters nothing to inspect, and the password-protected archive that follows a reply carries its password as an image that text scanners cannot read. Microsoft's own mitigations, phishing-resistant multi-factor authentication and checking senders through known contact details, accept that the first email cannot be caught on content.

Counter-view: Google's Threat Intelligence Group tracks the same downloader and backdoor as NOROBOT and YESROBOT, and reported in 2025 that this FSB unit rewrote its tooling within days of an earlier exposure. On that record, publication changes the malware but not the method, and the impersonated institutions remain the durable asset.

Key tension: Whether naming Star Blizzard again imposes any cost on an FSB unit that has retooled after every exposure since the NCSC and AIVD warnings in March.

First Reported In

Update #14 · China alert puts old bugs on a 3-day clock

Microsoft· 12 Oct 2026

Read original →

Different Perspectives

ENISA

ENISA's 22 September threat report found only 23.8 per cent of NoName057(16)'s assessed claims were confirmed by independent availability checks, though the group produced 48 per cent of ideology-driven activity. The agency's numbers show public administration taking 31.8 per cent of attacks, mostly ideological DDoS.

LKA Hamburg

Hamburg's State Criminal Police Office led the operation that took the KillSec leak site on 30 September, with ten countries, Europol and Eurojust. Investigators link the group to around 1,000 suspected attacks, at least 70 in Germany, and the seizure blocks access to at least 110 terabytes of victims' data.

ASOS

ASOS said an unauthorised party reached names and contact details on third-party platforms after obtaining an employee's credentials by impersonating a trusted contact. It said it does not believe payment cards or account passwords were affected, and is investigating.

Check Point

Check Point updated its advisory on 20 September to say its 9.8-rated VPN certificate flaw had been exploited on Spark firewalls since 12 September, five days after the advisory first appeared, and shipped fixes including R81.20 Take 166. It told customers using only pre-shared-key VPN communities they were not exposed.

Japan's National Police Agency

Japan's National Police Agency and National Cybersecurity Office signed advisory AA26-281A and published it on 9 October, naming SoftEther VPN, MicroScan and office-cli and indicators detected since January 2016. Tokyo says the evidence comes from several FBI criminal investigations and that it will deepen cooperation with allies.

CISA

CISA gave federal agencies three days to fix five flaws from 2015 to 2023 on the day the China advisory named Integrity Technology Group, and set the same clock on 34 of 43 September listings. It treats a named state-linked operation as reason enough to patch old software within the week.