[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$flLEtjh9KtMwya-EEZOT_IiDrqS1V_hOB_qt8oaVdAWE":3},{"article":4,"iocs":40,"watch_terms":47,"solutions":48,"lesson":142},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":20,"category":21,"article_tags":24},"2a282f7c-edf5-4d6b-bfaa-3a7b260ee62e","Star Blizzard Targets 100+ Organizations with Phishing and RedFlick Technique","star-blizzard-targets-100-organizations-with-phishing-and-redflick-technique-07248d","Russian group Star Blizzard expands phishing campaigns with a new malware delivery RedFlick technique, using scheduled tasks to deliver the CosmicPulse backdoor.","Russian threat actor Star Blizzard has expanded its phishing campaigns to target over 100 organizations using a new malware delivery technique called RedFlick. The technique leverages scheduled tasks to deliver the CosmicPulse backdoor, representing an evolution in the group's attack methodology and demonstrating continued sophistication in their operational capabilities.","Russian group Star Blizzard targets 100+ organizations with phishing and RedFlick malware delivery technique.","https:\u002F\u002Fhackread.com\u002Fstar-blizzard-organizations-phishing-redflick-technique\u002F",null,"2026-10-05T11:01:08+00:00","2026-10-05T12:00:10.633194+00:00",8,[17],{"name":18,"type":19},"Star Blizzard","threat_actor","6cbdd207-aaa1-4176-9534-e156b125e917",{"id":20,"icon":12,"name":22,"slug":23},"Nation-state","nation-state",[25,30,35],{"category":26},{"id":27,"icon":12,"name":28,"slug":29},"2c8f44d4-b56e-47cf-9677-04f22c9ee78d","Identity & Access","identity-access",{"category":31},{"id":32,"icon":12,"name":33,"slug":34},"89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5","Malware","malware",{"category":36},{"id":37,"icon":12,"name":38,"slug":39},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[41,44],{"type":34,"value":42,"context":43},"CosmicPulse","Backdoor malware delivered via RedFlick technique using scheduled tasks",{"type":34,"value":45,"context":46},"RedFlick","Malware delivery technique used by Star Blizzard to deploy CosmicPulse",[],{"controls":49,"vendors":135},[50,79,108],{"slug":51,"name":52,"problem":53,"products":54},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[55,63,71],{"vendor_slug":56,"vendor_name":57,"vendor_logo":58,"product_slug":59,"product_name":60,"url":61,"description":62},"sentinelone","SentinelOne","\u002Fvendor-logos\u002Fsentinelone.png","singularity-endpoint","Singularity Endpoint","https:\u002F\u002Fwww.sentinelone.com\u002Fplatform\u002Fendpoint-security\u002F","Endpoint protection and detection with automated response and rollback.",{"vendor_slug":64,"vendor_name":65,"vendor_logo":66,"product_slug":67,"product_name":68,"url":69,"description":70},"crowdstrike","CrowdStrike","\u002Fvendor-logos\u002Fcrowdstrike.png","falcon-insight-xdr","Falcon Insight XDR","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fplatform\u002Fendpoint-security\u002Ffalcon-insight-xdr\u002F","Endpoint detection and response with extended detection across other security tools.",{"vendor_slug":72,"vendor_name":73,"vendor_logo":74,"product_slug":75,"product_name":76,"url":77,"description":78},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","defender-for-endpoint","Microsoft Defender for Endpoint","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fendpoint-security\u002Fmicrosoft-defender-endpoint","Endpoint detection and response for Windows, macOS, Linux and mobile devices.",{"slug":80,"name":81,"problem":82,"products":83},"email-security","Email security","Phishing, malware and invoice fraud are filtered out before they reach inboxes.",[84,92,100],{"vendor_slug":85,"vendor_name":86,"vendor_logo":87,"product_slug":88,"product_name":89,"url":90,"description":91},"darktrace","Darktrace","\u002Fvendor-logos\u002Fdarktrace.png","darktrace-email","Darktrace \u002F EMAIL","https:\u002F\u002Fwww.darktrace.com\u002Fproducts\u002Femail","Email security that flags messages deviating from normal communication patterns.",{"vendor_slug":93,"vendor_name":94,"vendor_logo":95,"product_slug":96,"product_name":97,"url":98,"description":99},"abnormal","Abnormal AI","\u002Fvendor-logos\u002Fabnormal.png","abnormal-email-security","Abnormal Inbound Email Security","https:\u002F\u002Fabnormal.ai\u002F","API-based email security for Microsoft 365 and Google Workspace using behavioural models.",{"vendor_slug":101,"vendor_name":102,"vendor_logo":103,"product_slug":104,"product_name":105,"url":106,"description":107},"check-point","Check Point","\u002Fvendor-logos\u002Fcheck-point.png","harmony-email","Harmony Email & Collaboration","https:\u002F\u002Fwww.checkpoint.com\u002Fharmony\u002Femail-security\u002F","Email and collaboration security for Microsoft 365 and Google Workspace.",{"slug":109,"name":110,"problem":111,"products":112},"security-awareness-training","Security awareness training and phishing simulation","People recognise and report attacks instead of falling for them.",[113,120,127],{"vendor_slug":114,"vendor_name":115,"vendor_logo":116,"product_slug":109,"product_name":117,"url":118,"description":119},"knowbe4","KnowBe4","\u002Fvendor-logos\u002Fknowbe4.png","KnowBe4 Security Awareness Training","https:\u002F\u002Fwww.knowbe4.com\u002Fproducts\u002Fsecurity-awareness-training","Training library and simulated phishing with reporting.",{"vendor_slug":121,"vendor_name":122,"vendor_logo":123,"product_slug":121,"product_name":124,"url":125,"description":126},"sosafe","SoSafe","\u002Fvendor-logos\u002Fsosafe.png","SoSafe Awareness Platform","https:\u002F\u002Fsosafe-awareness.com\u002F","Behaviour-based awareness training and phishing simulation in many languages.",{"vendor_slug":128,"vendor_name":129,"vendor_logo":130,"product_slug":131,"product_name":132,"url":133,"description":134},"huntress","Huntress","\u002Fvendor-logos\u002Fhuntress.png","managed-sat","Huntress Managed Security Awareness Training","https:\u002F\u002Fwww.huntress.com\u002Fplatform\u002Fsecurity-awareness-training","Security awareness training and phishing simulation, managed for you.",[136],{"slug":137,"name":138,"logo_path":139,"roles":140},"google","Google","\u002Fvendor-logos\u002Fgoogle.png",[141],"reported_by",{"slug":143,"title":144,"body":145,"framework_refs":146,"framework_notes":158},"star-blizzard-expands-phishing-campaigns-using-redflick-malware-delivery-technique","Star Blizzard Expands Phishing Campaigns Using RedFlick Malware Delivery Technique","Russian state-sponsored threat actor Star Blizzard has targeted over 100 organizations using a sophisticated phishing campaign combined with a novel malware delivery method called RedFlick, which abuses Windows scheduled tasks to install the CosmicPulse backdoor. The root cause lies in insufficient user security awareness and a failure to detect and block advanced phishing lures before they reach end users. Once delivered, the scheduled task persistence mechanism allows attackers to maintain long-term footholds that can go undetected without robust endpoint and behavioral monitoring. This attack demonstrates that nation-state adversaries continuously evolve their tactics, making both human vigilance and technical detection controls critical layers of defense.",[147,148,149,150,151,152,153,154,155,156,157],"CIS Control 9 – Email and Web Browser Protections","CIS Control 14 – Security Awareness and Skills Training","CIS Control 17 – Incident Response Management","NIST SP 800-53 SI-3 – Malicious Code Protection","NIST SP 800-53 AT-2 – Literacy Training and Awareness","NIST SP 800-53 AU-6 – Audit Record Review, Analysis, and Reporting","NIST SP 800-53 IR-4 – Incident Handling","MITRE ATT&CK T1053.005 – Scheduled Task\u002FJob: Scheduled Task","MITRE ATT&CK T1566 – Phishing","NIST CSF DE.CM-1 – Networks are monitored to detect cybersecurity events","ITIL – Major Incident Management & Continual Service Improvement",{}]