Russian Hackers Wait for Your Reply, Then Attack
The Russian state-backed group Star Blizzard has adopted a phishing technique that sends a completely harmless first email and only delivers malware after the recipient replies, according to Microsoft Threat Intelligence.
Key facts
Who: Star Blizzard, also known as Callisto and ColdRiver, linked by Western governments to Russia's Federal Security Service (FSB)
The technique: RedFlick, a malware delivery method requiring only one user interaction
The payload: CosmicPulse, the group's custom backdoor
Scale: At least 13 distinct large-scale phishing campaigns since January 2026, hitting more than 100 organizations
Who's targeted: Ukrainians, plus NGOs, think tanks, governments and financial institutions supporting Ukraine — primarily in the US and UK
Microsoft's advice: Phishing-resistant authentication, Conditional Access policies, email protection, and verifying suspicious messages through known contact details
How does the RedFlick technique work?
By splitting the attack in two.
The first email is an ordinary-looking message — an invitation, for example — with no attachment and nothing malicious in it. Security tools scanning that message find nothing, because there is nothing to find.
Once the recipient replies, the attackers send a second message containing a password-protected ZIP or RAR archive, with the password supplied as an image inside the email. That archive begins the infection.
The password and the image are both deliberate. Encryption prevents security tools without decryption capability from inspecting the archive contents, and a password shown as an image cannot be read by text-scanning systems.
The archive has contained a virtual hard disk file — a VHDX, which Windows mounts like a drive — holding a shortcut file disguised as a PDF. Opening it runs hidden commands that create scheduled tasks to collect the computer name and username and retrieve further malware from attacker infrastructure.
Why does the reply matter so much?
Because it converts a cold email into an established conversation.
By the time the dangerous message arrives, the recipient has already engaged. The thread looks like correspondence they started participating in. Microsoft notes RedFlick requires only a single user interaction, reducing friction compared with the group's previous approach, which needed victims to complete several manual steps.
What's changed about Star Blizzard?
Its scale. Microsoft says the group shifted in 2026 from exclusively targeted spear-phishing to also running larger campaigns — ranging from tens to hundreds of email messages each, at a scale not previously seen from this actor.
Despite the change in tactics, the group still impersonates trusted contacts or organizations and still uses free email providers to send its phishing messages.
What should organizations do?
Microsoft recommends phishing-resistant authentication, Conditional Access policies, email protection and endpoint detection and response.
The behavioral defense is simpler and worth stating plainly for staff: replying to an unexpected email is not a safe action. Most phishing training teaches people not to click links or open attachments, and this technique is built specifically around that gap — the first message asks for neither.
Two concrete rules: verify unexpected contact through a channel you already have, not by replying; and treat a password-protected archive from outside your organization as hostile unless you were expecting it and can confirm the sender independently.