Star Blizzard refines phishing and malware delivery with the RedFlick technique

Since January 2026, the Russian state threat actor Star Blizzard has enhanced its cyberespionage operations by adopting a new malware delivery technique called RedFlick, alongside large-scale phishing campaigns and use of compromised website accounts. These tactics improve detection evasion and target Ukrainian individuals and institutions, as well as international NGOs, Western think tanks, governments, and organizations linked to Ukraine support. Indicators include multiple malicious domains, file hashes, and an IP address associated with the campaign. No specific software vulnerabilities or CVEs are identified.

• Adversary Unmasked APT Profile · Star BlizzardThreat Actor2026-10-28
• Fake Zillow pages use ClickFix NetSupport RAT to target apartment huntersMalware2026-11-13
• Beware of Phishing Email Disguised as Quotation Inquiry (SnakeKeylogger)Malware2026-11-12
• Off the Rails: Inside an Exposed Silent Lynx ServerMalware2026-11-11
• Beyond the clipboard: The evolving tradecraft of ClickFixMalware2026-11-10