Star Blizzard Deploys Backdoor via Fake Event Invitations in Campaign Targeting Ukraine-Linked Organizations

What Happened

According to Microsoft, the Russian state-sponsored threat group tracked as Star Blizzard has been running a campaign using fake event invitations to trick targets into installing a backdoor on Windows systems. The campaign has been active since January 2026 and has affected more than 100 organizations, primarily in the U.S. and U.K., with targets tied to Ukraine. Microsoft has confirmed at least one successful infection; the full scope of how many systems were actually breached (versus just targeted) has not been disclosed.

Why It Matters

Star Blizzard (also tracked by other vendors under different names) is a known Russian state actor with a history of credential-harvesting and espionage operations against government, defense, NGO, and civil-society targets connected to Ukraine and its allies. A social-engineering lure built around fake event invites is notable because it targets a common workflow — calendar/meeting invitations — that many organizations do not scrutinize as closely as generic phishing emails. Organizations and individuals involved in Ukraine-related policy, humanitarian, journalism, or diplomatic work should consider themselves potential targets, even if they haven't seen direct evidence of compromise.

What Defenders Should Watch For

• Be wary of unsolicited calendar/event invitations, especially those referencing conferences, briefings, or diplomatic/humanitarian events tied to Ukraine, that prompt a file download or link click to "view details" or "join."
• Hunt for unusual process execution chains originating from email clients, browsers, or calendar applications leading to script interpreters (PowerShell, wscript, mshta) or unexpected binaries.
• Review outbound network connections from user endpoints for newly established or beaconing connections shortly after opening email attachments or links, which may indicate backdoor check-in activity.
• Reinforce user awareness training specifically calling out invite-themed lures, since these may bypass instincts trained on more generic phishing patterns.
• Ensure endpoint detection tooling and mail security gateways are configured to flag attachments/links delivered via calendar-invite-style content, and review Microsoft's own advisory for available indicators once published.

Developing Intel

This is a developing story based on Microsoft's reporting, and full technical indicators of compromise (file hashes, C2 infrastructure, specific lure content) were not detailed in the initial coverage available at publication time. Defenders should treat the detection ideas above as a starting point and monitor for updated technical detail. For the original reporting, see The Hacker News.