Star Blizzard Targets 100+ Organizations with Phishing and RedFlick Technique
Russian group Star Blizzard targets 100+ organizations with phishing and RedFlick malware delivery technique.
Russian threat actor Star Blizzard has expanded its phishing campaigns to target over 100 organizations using a new malware delivery technique called RedFlick. The technique leverages scheduled tasks to deliver the CosmicPulse backdoor, representing an evolution in the group's attack methodology and demonstrating continued sophistication in their operational capabilities.
AI summary of the linked source. Not reviewed by an editor. How this works
The lesson from this incident
Full lessonRussian state-sponsored threat actor Star Blizzard has targeted over 100 organizations using a sophisticated phishing campaign combined with a novel malware delivery method called RedFlick, which abuses Windows scheduled tasks to install the CosmicPulse backdoor. The root cause lies in insufficient user security awareness and a failure to detect and block advanced phishing lures before they reach end users. Once delivered, the scheduled task persistence mechanism allows attackers to maintain long-term footholds that can go undetected without robust endpoint and behavioral monitoring. This attack demonstrates that nation-state adversaries continuously evolve their tactics, making both human vigilance and technical detection controls critical layers of defense.
What helps against this
How we list vendors
- Endpoint detection and response (EDR and XDR)
Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.
- Email security
Phishing, malware and invoice fraud are filtered out before they reach inboxes.
- Security awareness training and phishing simulation
People recognise and report attacks instead of falling for them.
Indicators of Compromise
Extracted by AI from the linked source. Not reviewed by an editor. How this works
- malware — CosmicPulse
- malware — RedFlick