[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fA0PiLberU7LmLtF8RRdynXpPdNidZY5IPj7qiJeGQAU":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"framework_notes":22,"status":23,"created_at":24,"published_at":25,"article":26,"tags":30,"podcasts":43,"controls":44},"a25913c5-c6fb-4485-bce3-2d546e26399f","star-blizzard-evolves-phishing-tactics-with-redflick-campaign","34ecee87-3acf-4d16-887b-960bd599aeb5","Star Blizzard Evolves Phishing Tactics with RedFlick Campaign","Russian APT group Star Blizzard has pivoted from their ClickFix tool to a new phishing technique dubbed 'RedFlick,' targeting high-value civil society organizations such as NGOs, think tanks, and journalists supporting Ukraine. The campaign's goal is to deploy the CosmicPulse backdoor, enabling persistent access and espionage. This shift highlights how sophisticated threat actors continuously adapt their tactics to evade detection and maintain effectiveness against soft targets with limited cybersecurity resources. Organizations in advocacy and journalism roles are frequently under-resourced for cyber defense, making them attractive vectors for state-sponsored actors seeking geopolitical intelligence.","**Immediate actions:**\n- Deploy advanced email filtering with sandboxing to analyze and block phishing lures before they reach end users.\n- Mandate phishing-resistant MFA (e.g., FIDO2\u002Fhardware keys) for all staff, especially those with access to sensitive communications or systems.\n\n**Security awareness & training:**\n- Conduct targeted phishing simulation exercises tailored to spear-phishing scenarios relevant to NGOs, journalists, and think tanks.\n- Train staff to recognize social engineering tactics that create urgency or mimic trusted entities, and establish a clear internal reporting procedure for suspicious messages.\n\n**Detection & response measures:**\n- Implement endpoint detection and response (EDR) tools capable of identifying backdoor behaviors such as those associated with CosmicPulse.\n- Establish threat intelligence feeds that track APT group TTPs (e.g., Star Blizzard\u002FSEABORGIUM) and configure SIEM alerts for associated indicators of compromise (IOCs).\n- Define and rehearse an incident response playbook specifically for nation-state phishing intrusions, including forensic preservation and stakeholder notification steps.",[12,13,14,15,16,17,18,19,20,21],"CIS Control 9 – Email and Web Browser Protections","CIS Control 14 – Security Awareness and Skills Training","CIS Control 17 – Incident Response Management","NIST SP 800-61 – Computer Security Incident Handling Guide","NIST SP 800-53 SI-8 – Spam Protection","NIST SP 800-53 AT-2 – Literacy Training and Awareness","NIST SP 800-53 IR-4 – Incident Handling","MITRE ATT&CK T1566 – Phishing","MITRE ATT&CK T1059 – Command and Scripting Interpreter (CosmicPulse backdoor behavior)","GDPR Article 32 – Security of Processing (for EU-based NGOs handling personal data)",{},"published","2026-09-30T16:22:02.971928+00:00","2026-09-30T16:22:02.201+00:00",{"id":7,"url":27,"slug":28,"title":29},"https:\u002F\u002Fwww.darkreading.com\u002Fthreat-intelligence\u002Frussia-star-blizzard-apt-ditches-clickfix-widen-phishing-net","russia-s-star-blizzard-ditches-clickfix-to-widen-phishing-net-ec979f","Russia's Star Blizzard Ditches ClickFix to Widen Phishing Net",[31,37],{"id":32,"name":33,"slug":34,"description":35,"color":36},"182e11d5-57c4-444e-8ec8-4682ad60261b","Incident Response","incident-response","Slow detection, poor containment, missing playbooks","#14b8a6",{"id":38,"name":39,"slug":40,"description":41,"color":42},"7261eb8f-acd4-4d93-a489-7fdd652ec0ea","Security Awareness","security-awareness","Phishing, social engineering, human error","#22c55e",[],[45,49,53],{"slug":46,"name":47,"problem":48},"phishing-resistant-mfa","Phishing-resistant MFA","A stolen password, or a user who taps Approve on a push prompt, is no longer enough to log in.",{"slug":50,"name":51,"problem":52},"email-security","Email security","Phishing, malware and invoice fraud are filtered out before they reach inboxes.",{"slug":54,"name":55,"problem":56},"security-awareness-training","Security awareness training and phishing simulation","People recognise and report attacks instead of falling for them."]