Russian Hackers Use Fraudulent Meeting Invitations to Compromise Over 100 Organizations

Russian state-sponsored hackers dubbed Star Blizzard have deployed a campaign distributing backdoor malware through counterfeit event invitations, primarily targeting Ukrainian-affiliated entities and organizations in the U.S. and U.K. since January. The social engineering operation has successfully compromised at least one system, with Microsoft reporting over 100 organizations exposed to the malicious invitations. The attacks demonstrate how threat actors continue to exploit human trust as an entry vector for establishing persistent system access.

State-sponsored threat actors operating under the designation Star Blizzard have initiated a social engineering campaign that weaponizes a common workplace tool: meeting invitations. By creating fraudulent event notices, the group has distributed backdoor malware designed to establish unauthorized access to target systems. The operation has maintained activity since the start of 2024, with Ukrainian organizations appearing to be the primary focus, though entities across the United States and United Kingdom have also been targeted.

Microsoft's security researchers identified the scope of the threat after analyzing the distribution pattern, determining that over 100 organizations had received these malicious invitations. The success of this approach underscores a persistent vulnerability in cybersecurity defenses: the human element. Even in security-conscious organizations, legitimate-seeming calendar invitations can bypass initial scrutiny, allowing attackers to deliver malware directly to employee systems.