The activity is aimed at individuals and organizations tied to Ukraine, and has touched more than 100 organizations since January, with most targets located in the U.S. and U.K. At least one machine was confirmed infected, though the full number of compromised systems has not been disclosed.

Key points:

• Star Blizzard is attributed to the Russian state and has previously been linked to credential-harvesting and espionage operations.
• The current wave relies on convincing fake event invites as the initial lure.
• The end goal is deployment of a backdoor on Windows hosts.
• Targeting is concentrated on entities connected to Ukraine, primarily in the U.S. and U.K.

Microsoft has not released specific indicators such as CVE identifiers or file hashes in this report, so defenders should focus on behavioral detection: unexpected event-invite emails, suspicious attachment or link chains, and anomalous process execution on endpoints.

Mitigation guidance:

• Treat unsolicited event invitations with suspicion, especially those referencing Ukraine-related topics.
• Verify sender domains and links out-of-band before interacting.
• Enforce phishing-resistant MFA and monitor for unusual authentication activity.
• Harden Windows endpoints and review email filtering rules for invitation-style lures.

Source: The Hacker News

Has your organization seen an uptick in event-themed phishing lures, and how are you tuning detection to catch them?