[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fqGUSxvW1hOH3zzaXBj9l54SdGWxprao-CzgrjmcNLqc":3},{"article":4,"iocs":41,"watch_terms":45,"solutions":46,"lesson":140},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":23,"category":24,"article_tags":28},"34ecee87-3acf-4d16-887b-960bd599aeb5","Russia's Star Blizzard Ditches ClickFix to Widen Phishing Net","russia-s-star-blizzard-ditches-clickfix-to-widen-phishing-net-ec979f","The APT actor is using a new tactic, dubbed \"RedFlick,\" against Ukrainian-linked targets such as NGOs, think tanks, and journalists to deploy its CosmicPulse backdoor.","Russian APT group Star Blizzard has adopted a new phishing tactic called 'RedFlick' to target Ukrainian-linked organizations, including NGOs, think tanks, and journalists. This new approach aims to deploy their CosmicPulse backdoor, marking a shift from their previous ClickFix tool.","Russia's Star Blizzard APT uses new RedFlick tactic for phishing attacks against Ukrainian targets.","https:\u002F\u002Fwww.darkreading.com\u002Fthreat-intelligence\u002Frussia-star-blizzard-apt-ditches-clickfix-widen-phishing-net","https:\u002F\u002Feu-images.contentstack.com\u002Fv3\u002Fassets\u002Fblt6d90778a997de1cd\u002Fblt6f6d60565804fe81\u002F6abcff0189b51bddd40e0d6e\u002Fsnowflakes-Ulrick-T-Alamy.png?width=720&quality=80&disable=upscale","2026-09-30T15:02:25+00:00","2026-09-30T16:00:38.179711+00:00",8,[17,20],{"name":18,"type":19},"Star Blizzard","threat_actor",{"name":21,"type":22},"RedFlick","campaign","6cbdd207-aaa1-4176-9534-e156b125e917",{"id":23,"icon":25,"name":26,"slug":27},null,"Nation-state","nation-state",[29,31,36],{"category":30},{"id":23,"icon":25,"name":26,"slug":27},{"category":32},{"id":33,"icon":25,"name":34,"slug":35},"89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5","Malware","malware",{"category":37},{"id":38,"icon":25,"name":39,"slug":40},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[42],{"type":35,"value":43,"context":44},"CosmicPulse","Backdoor deployed by Star Blizzard",[],{"controls":47,"vendors":133},[48,77,106],{"slug":49,"name":50,"problem":51,"products":52},"phishing-resistant-mfa","Phishing-resistant MFA","A stolen password, or a user who taps Approve on a push prompt, is no longer enough to log in.",[53,61,69],{"vendor_slug":54,"vendor_name":55,"vendor_logo":56,"product_slug":57,"product_name":58,"url":59,"description":60},"okta","Okta","\u002Fvendor-logos\u002Fokta.png","workforce-identity","Okta Workforce Identity","https:\u002F\u002Fwww.okta.com\u002Fproducts\u002Fworkforce-identity\u002F","Single sign-on, adaptive MFA including phishing-resistant methods, and lifecycle management for employees.",{"vendor_slug":62,"vendor_name":63,"vendor_logo":64,"product_slug":65,"product_name":66,"url":67,"description":68},"cisco","Cisco","\u002Fvendor-logos\u002Fcisco.png","duo","Cisco Duo","https:\u002F\u002Fduo.com\u002F","MFA and device trust, with support for passkeys and security keys.",{"vendor_slug":70,"vendor_name":71,"vendor_logo":72,"product_slug":73,"product_name":74,"url":75,"description":76},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","entra-id","Microsoft Entra ID","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fidentity-access\u002Fmicrosoft-entra-id","Cloud identity and access management with single sign-on, conditional access, passkeys and identity governance.",{"slug":78,"name":79,"problem":80,"products":81},"email-security","Email security","Phishing, malware and invoice fraud are filtered out before they reach inboxes.",[82,90,98],{"vendor_slug":83,"vendor_name":84,"vendor_logo":85,"product_slug":86,"product_name":87,"url":88,"description":89},"abnormal","Abnormal AI","\u002Fvendor-logos\u002Fabnormal.png","abnormal-email-security","Abnormal Inbound Email Security","https:\u002F\u002Fabnormal.ai\u002F","API-based email security for Microsoft 365 and Google Workspace using behavioural models.",{"vendor_slug":91,"vendor_name":92,"vendor_logo":93,"product_slug":94,"product_name":95,"url":96,"description":97},"mimecast","Mimecast","\u002Fvendor-logos\u002Fmimecast.png","mimecast-email-security","Mimecast Email Security","https:\u002F\u002Fwww.mimecast.com\u002Fproducts\u002Femail-security\u002F","Email filtering, impersonation protection and continuity.",{"vendor_slug":99,"vendor_name":100,"vendor_logo":101,"product_slug":102,"product_name":103,"url":104,"description":105},"cloudflare","Cloudflare","\u002Fvendor-logos\u002Fcloudflare.png","cloudflare-email-security","Cloudflare Email Security","https:\u002F\u002Fwww.cloudflare.com\u002Fsase\u002Fproducts\u002Femail-security\u002F","Email filtering for phishing and business email compromise.",{"slug":107,"name":108,"problem":109,"products":110},"security-awareness-training","Security awareness training and phishing simulation","People recognise and report attacks instead of falling for them.",[111,118,125],{"vendor_slug":112,"vendor_name":113,"vendor_logo":114,"product_slug":107,"product_name":115,"url":116,"description":117},"knowbe4","KnowBe4","\u002Fvendor-logos\u002Fknowbe4.png","KnowBe4 Security Awareness Training","https:\u002F\u002Fwww.knowbe4.com\u002Fproducts\u002Fsecurity-awareness-training","Training library and simulated phishing with reporting.",{"vendor_slug":119,"vendor_name":120,"vendor_logo":121,"product_slug":119,"product_name":122,"url":123,"description":124},"sosafe","SoSafe","\u002Fvendor-logos\u002Fsosafe.png","SoSafe Awareness Platform","https:\u002F\u002Fsosafe-awareness.com\u002F","Behaviour-based awareness training and phishing simulation in many languages.",{"vendor_slug":126,"vendor_name":127,"vendor_logo":128,"product_slug":129,"product_name":130,"url":131,"description":132},"huntress","Huntress","\u002Fvendor-logos\u002Fhuntress.png","managed-sat","Huntress Managed Security Awareness Training","https:\u002F\u002Fwww.huntress.com\u002Fplatform\u002Fsecurity-awareness-training","Security awareness training and phishing simulation, managed for you.",[134],{"slug":135,"name":136,"logo_path":137,"roles":138},"google","Google","\u002Fvendor-logos\u002Fgoogle.png",[139],"reported_by",{"slug":141,"title":142,"body":143,"framework_refs":144,"framework_notes":155},"star-blizzard-evolves-phishing-tactics-with-redflick-campaign","Star Blizzard Evolves Phishing Tactics with RedFlick Campaign","Russian APT group Star Blizzard has pivoted from their ClickFix tool to a new phishing technique dubbed 'RedFlick,' targeting high-value civil society organizations such as NGOs, think tanks, and journalists supporting Ukraine. The campaign's goal is to deploy the CosmicPulse backdoor, enabling persistent access and espionage. This shift highlights how sophisticated threat actors continuously adapt their tactics to evade detection and maintain effectiveness against soft targets with limited cybersecurity resources. Organizations in advocacy and journalism roles are frequently under-resourced for cyber defense, making them attractive vectors for state-sponsored actors seeking geopolitical intelligence.",[145,146,147,148,149,150,151,152,153,154],"CIS Control 9 – Email and Web Browser Protections","CIS Control 14 – Security Awareness and Skills Training","CIS Control 17 – Incident Response Management","NIST SP 800-61 – Computer Security Incident Handling Guide","NIST SP 800-53 SI-8 – Spam Protection","NIST SP 800-53 AT-2 – Literacy Training and Awareness","NIST SP 800-53 IR-4 – Incident Handling","MITRE ATT&CK T1566 – Phishing","MITRE ATT&CK T1059 – Command and Scripting Interpreter (CosmicPulse backdoor behavior)","GDPR Article 32 – Security of Processing (for EU-based NGOs handling personal data)",{}]