Russian state hackers use new RedFlick technique to push malware

Russian state hackers are utilizing a new delivery method known as the RedFlick technique to distribute malware. According to reports from BleepingComputer and Microsoft, this method is being employed by Star Blizzard, a group linked to the Russian FSB. The operation involves scaling up phishing attacks specifically targeting supporters of Ukraine. The Hacker News reports that Star Blizzard has targeted over 100 organizations using fake event invitations as a lure to deliver a backdoor. This strategic shift represents a refinement in how the group handles malware delivery to penetrate target systems. Coverage from gbhackers.com provides technical specifics on the RedFlick mechanism, noting that it utilizes password-protected archives and scheduled tasks to deploy the CosmicPulse backdoor.

Dark Reading highlights that Star Blizzard is moving away from the ClickFix method in an effort to widen its phishing net. This transition indicates a tactical evolution in the group's toolkit to evade detection and increase the success rate of their intrusions. Microsoft has specifically identified RedFlick as a refined approach to both phishing and the subsequent delivery of malicious software. Context provided by The Record from Recorded Future News emphasizes the geopolitical motivations behind these actions, noting the specific focus on individuals and organizations that support Ukraine. The scale of the campaign is significant, as evidenced by the targeting of more than 100 distinct organizations. The use of password-protected archives is a known tactic to bypass security scanners, while the use of scheduled tasks ensures that the CosmicPulse backdoor maintains a presence on the infected system.

This combination of social engineering via fake invites and technical obfuscation underscores the sophistication of the FSB-linked actors. Future monitoring will likely focus on the deployment of the CosmicPulse backdoor across the identified target organizations. Because Star Blizzard has ditched ClickFix to expand its reach, security analysts will be watching for further iterations of the RedFlick technique. The coverage indicates a trend of escalating phishing activity against Ukraine supporters, suggesting that these targets will remain a priority for the Russian state actors. Organizations should look for indicators of compromise involving fake event invitations and the specific archival methods mentioned in the technical reports from gbhackers.com and Microsoft.