Threat Intel
Star Blizzard Shifts to RedFlick Phishing, Deploys CosmicPulse Backdoor
Star Blizzard, a Russia‑linked APT group, has moved from ClickFix to a new phishing technique called RedFlick, enabling delivery of the CosmicPulse backdoor with reduced user interaction. The change targets Ukrainian‑linked NGOs, think tanks, and journalists, increasing compromise likelihood and evasion of detection. Defenders should update email filters, deploy EDR signatures, and monitor for CosmicPulse indicators.
What Happened
Star Blizzard, a Russia‑linked APT group active since 2017, has abandoned its ClickFix phishing method in favor of a new technique called RedFlick. The change allows the group to deliver the CosmicPulse backdoor with less user interaction and higher evasion of detection.
Impact
Targets are primarily Ukrainian‑linked NGOs, think tanks, and journalists. The CosmicPulse payload can provide persistent access and exfiltration capabilities. The shift to RedFlick increases the likelihood of successful compromise and reduces the chance of detection by traditional email filters.
What to Do
- Update email filtering rules to flag RedFlick indicators, such as shortened URLs and suspicious attachment names.
- Deploy endpoint detection and response (EDR) solutions that include signatures for CosmicPulse.
- Conduct user awareness training focused on phishing with minimal interaction cues.
- Monitor for unusual outbound traffic to known CosmicPulse command‑and‑control domains.
- Apply the latest Microsoft security updates and consider blocking known malicious domains via DNS filtering.
Mitigation Guidance
Use multi‑factor authentication for all privileged accounts, enforce least‑privilege, and isolate compromised endpoints immediately. Regularly review logs for indicators of compromise (IOCs) associated with RedFlick and CosmicPulse.
Related articles
Russia Shifts from Torrenting to Streaming: Implications for SecOps
Russian users are moving away from torrent sites toward online streaming for pirated content, creating new malware and phishing vectors. Defenders must update threat intel, block malicious domains, and monitor traffic for abnormal streaming patterns.
Read briefing
Chinese Espionage Group Deploys New SparroWocky Backdoor in Latin America
FamousSparrow, a China‑linked threat actor, has moved beyond its old SparrowDoor tool and rolled out the modular C++ backdoor SparroWocky against government entities across Latin America. The malware uses sophisticated anti‑analysis tricks—DLL side‑loading, RC4‑encoded payloads, dynamic API resolution, and CreateThread hooking—to evade detection. It can execute commands, exfiltrate data, capture high‑frequency screenshots, proxy traffic, and even wipe its own traces. ESET’s analysis pinpoints 18 C2 endpoints and shows the operation has been active for over a year, targeting Argentina, Ecuador,
Read briefing
FamousSparrow Deploys SparroWocky Backdoor Across Latin America
The state‑sponsored group FamousSparrow has rolled out a new modular C++ backdoor, SparroWocky, targeting government and critical infrastructure in Latin America since August 2025. The implant can execute arbitrary code, act as a TCP proxy, exfiltrate data, and hide its presence using MinHook and COFF Loader techniques. Defenders should block the known C2 IP, monitor for suspicious TLS traffic, and detect MinHook‑based thread hiding.
Read briefing
Fake Celine Dion Ticket Scam Targets Fans via Social Media and Impersonating Sites
Group‑IB uncovered a multi‑layered phishing scheme selling counterfeit Celine Dion concert tickets. The attack uses social‑network messages and spoofed distributor sites to lure buyers. Defenders should block malicious domains, monitor for ticket‑related phishing, and educate users.
Read briefing