RedFlick campaigns hit more than 100 organizations
Assessment
Microsoft said it 'observed this activity affect over 100 organizations primarily in the United States and United Kingdom' — a figure from Microsoft's own telemetry that counts organizations observed affected, not confirmed breaches. Microsoft did not publish how many were compromised, and The Hacker News noted at least one machine was infected but the number of breached organizations was not disclosed. Downstream coverage that repeats '100+' as organizations breached or compromised goes beyond what the source states.
Where this claim appeared
The Hacker News · 2026-09-29
https://thehackernews.com/2026/09/russias-star-blizzard-targets-100.htmlWhat “Weak Evidence” means
Evidence exists but is thin, circumstantial, or explicitly qualified as weak by the source that published it. Shared hosting infrastructure between threat clusters is the recurring example.
3 of 5 · rating scale
Assessed in
Star Blizzard's RedFlick technique delivers the CosmicPulse backdoor to 100+ organizationsThink this assessment is wrong? Report an error.