# Star Blizzard cyber espionage expansion > Live situation record from CLSTR: https://clstr.news/situations/star-blizzard-cyber-espionage-expansion > Updated: 2026-09-30T05:25:02.000Z. Sources: 7. Developments: 2. The Russian-linked hacking group Star Blizzard, also known as Callisto or ColdRiver, has significantly expanded its cyberattack operations. Moving away from exclusively targeted spear-phishing, the group has transitioned to larger-scale campaigns using automated mass-mailing platforms to reach hundreds of potential victims. A central component of this expansion is the deployment of a new malware delivery technique called ‘RedFlick’. This method utilizes password-protected archives that execute background scripts to deploy malware such as NoroBot or BaitSwitch. The group has also been observed creating accounts on compromised websites to impersonate reputable organizations. These operations have targeted over 100 organizations, primarily in the United States and the United Kingdom. The campaign focuses on government agencies, financial institutions, NGOs, and think tanks, with a notable emphasis on Ukrainian individuals and entities that provide political or financial support to Ukraine. ## Timeline ### 2026-09-30: Star Blizzard hackers scale up phishing attacks using RedFlick technique Russian-linked hacking group Star Blizzard has scaled up phishing attacks using a new ‘RedFlick’ technique, targeting over 100 organizations in the US, UK, and Ukraine that support Ukrainian interests. 3 sources. https://clstr.news/cluster/star-blizzard-hackers-scale-up-phishing-attacks-using-redflick-technique ### 2026-09-28: Microsoft reports expansion of Star Blizzard phishing and disruption of AI-driven EvilTokens Microsoft reports that Russian-linked Star Blizzard has expanded phishing via new malware, while the AI-powered cybercrime service EvilTokens has been disrupted following thousands of email breaches. 4 sources. https://clstr.news/cluster/star-blizzard-hackers-expand-global-cyberespionage-targeting-ukraine-us-and-uk --- Cite as: Star Blizzard cyber espionage expansion. CLSTR, https://clstr.news/situations/star-blizzard-cyber-espionage-expansion