Russia's Star Blizzard Ditches ClickFix to Widen Phishing Net
Russia's Star Blizzard APT uses new RedFlick tactic for phishing attacks against Ukrainian targets.
Russian APT group Star Blizzard has adopted a new phishing tactic called 'RedFlick' to target Ukrainian-linked organizations, including NGOs, think tanks, and journalists. This new approach aims to deploy their CosmicPulse backdoor, marking a shift from their previous ClickFix tool.
AI summary of the linked source. Not reviewed by an editor. How this works
The lesson from this incident
Full lessonRussian APT group Star Blizzard has pivoted from their ClickFix tool to a new phishing technique dubbed 'RedFlick,' targeting high-value civil society organizations such as NGOs, think tanks, and journalists supporting Ukraine. The campaign's goal is to deploy the CosmicPulse backdoor, enabling persistent access and espionage. This shift highlights how sophisticated threat actors continuously adapt their tactics to evade detection and maintain effectiveness against soft targets with limited cybersecurity resources. Organizations in advocacy and journalism roles are frequently under-resourced for cyber defense, making them attractive vectors for state-sponsored actors seeking geopolitical intelligence.
What helps against this
How we list vendors
- Phishing-resistant MFA
A stolen password, or a user who taps Approve on a push prompt, is no longer enough to log in.
- Email security
Phishing, malware and invoice fraud are filtered out before they reach inboxes.
- Security awareness training and phishing simulation
People recognise and report attacks instead of falling for them.
Indicators of Compromise
Extracted by AI from the linked source. Not reviewed by an editor. How this works
- malware — CosmicPulse