Star Blizzard Campaign Targets 100+ Organizations with Fake Event Invitations

According to Microsoft, the Russian state-sponsored threat actor Star Blizzard has been running campaigns since January 2026 that target individuals and organizations tied to Ukraine. The attackers use fake event invitations as lures to deliver a backdoor to Windows computers. The campaigns have affected more than 100 organizations, with the majority of victims located in the United States and the United Kingdom. While at least one computer has been confirmed infected, Microsoft has not disclosed the exact number of successful breaches or the specific data exfiltrated. The campaign targets government entities, think tanks, and non-governmental organizations (NGOs). Microsoft states that no specific patch has been released for this campaign, as the attack vector relies on social engineering via email. The company recommends user awareness and robust email security best practices as the primary mitigation strategies. Star Blizzard is a known Russian APT group previously linked to similar credential harvesting and malware delivery operations.