Microsoft counted at least 13 large-scale campaigns since January, reaching more than 100 organizations primarily in the United States and United Kingdom.

 

What happened

Star Blizzard, a Russian state threat actor that CISA attributes to the Federal Security Service, ran at least 13 large-scale phishing campaigns between January and August 2026, each sending tens to hundreds of messages, Microsoft Threat Intelligence reported on September 29. More than 100 organizations were affected. Earlier operations by the same actor relied on individually targeted messages to a small number of recipients. Targets have been non-government organizations, think tanks, governments, and financial institutions connected to Ukraine policy, rather than healthcare, though the delivery methods are aimed at the same email filtering every sector relies on.

 

Going deeper

The first email carries no attachment at all, usually an invitation to a closed roundtable or conference attributed to a well-known policy institute, and exists only to identify who replies. Anyone who responds receives a second message with a password-protected RAR or ZIP archive attached. The password appears as an image rather than as text, so a filter reading the message finds no password to use and cannot open the archive to inspect what is inside. Subject lines across the campaigns included invitations to roundtables on European security and global capital allocation, a payment advice note, a tax audit notice, and a water supply shutdown notice. Microsoft also observed several employees at the same organization targeted together, with messages written to resemble internal correspondence.

 

What was said

Star Blizzard "continues to impersonate trusted contacts that users or organizations would expect an email from," Microsoft wrote in its analysis. The company described a checkable detail in the sender address, noting that the impersonated organization's name appears in the part of the address before the @ symbol rather than in the domain itself, and said this should raise a red flag about the email's authenticity. Where any doubt exists, its advice is to contact the person directly through a phone number or email address already known to be theirs.

 

In the know

Since March, the group has sent its phishing from accounts created on legitimate websites it has broken into, according to Microsoft, which assesses with high confidence that the sites were compromised for that purpose. The sites run common website software, and the same account name appears across several unrelated domains. Mail arriving from a genuine business website carries whatever sending reputation that site has built up over time. Earlier campaigns used free email services to impersonate known political figures, and the change coincided with the move to higher volume. A campaign in August concealed identifiers inside images, a technique known as steganography.

 

The big picture

Microsoft's recommendations for organizations facing this activity start with phishing-resistant authentication and conditional access policies restricting account access, in the guidance accompanying its research. It also advises turning on Safe Links and Safe Attachments so links are rechecked when someone clicks rather than only at delivery, enabling zero-hour auto purge to remove messages already sitting in mailboxes once new intelligence arrives, and using a firewall to block outbound SSH connections to external networks the business has no need to reach. CISA published its own advisory on this actor's credential phishing methods, available as AA23-341A. What healthcare organizations should take from the campaign is what it was built to defeat, since a first message carrying no attachment and no link gives filtering nothing to evaluate, an encrypted archive cannot be scanned, and a password supplied as an image cannot be read by anything processing text. Establishing what a mail gateway currently does with encrypted archives determines whether a message of this kind arrives intact.

 

FAQs

Why send an initial email with nothing in it?

The message tests whether the address is live and whether the recipient will engage, while giving filtering nothing to act on. Anyone who replies has identified themselves as reachable, which is why the attachment only arrives at the second stage.

 

Can email filtering open password-protected archives?

Only where the password is available to it. Some products attempt to extract a password from the message body and use it to open the attachment, which is what supplying the password as an image defeats.

 

What does the sender address tell involve checking?

Looking at what follows the @ symbol rather than the display name or the words before it. An address containing a well-known organization's name before the @ while resolving to an unrelated domain is claiming an affiliation the address itself does not support.

 

Why would attackers send mail from someone else's website?

A domain with a history of legitimate activity carries a reputation that filtering takes into account, and it has none of the characteristics of a domain registered last week. The site owner is usually unaware the accounts exist.

 

Should organizations block encrypted attachments entirely?

Many do, since legitimate senders rarely need them and those that do can usually deliver files another way. Organizations unable to block them outright can route them for additional review or restrict them to senders on an approved list.