Star Blizzard changes phishing delivery with RedFlick

Microsoft reported on 29 September that Star Blizzard had expanded phishing activity and adopted a malware-delivery technique it calls RedFlick. The company attributes the actor to Russian state-linked espionage and describes targeting associated with Ukraine, international policy and supporting organisations.

Researchers said the newer flow reduced the interaction required to deliver the actor’s CosmicPulse backdoor compared with its earlier ClickFix chains. The report also describes compromised sites and changes intended to evade detection. These are observations and assessments attributed to Microsoft’s intelligence team. The account gives defenders an updated view of a tracked operation rather than identifying all large phishing campaigns, or all use of compromised websites, as Star Blizzard activity.