The Russian APT actor Star Blizzard has been observed pivoting from its previously documented ClickFix tactic to a new approach designated RedFlick. The campaign targets Ukrainian-linked organizations globally, including non-governmental organizations, think tanks, and journalists, with the objective of deploying a previously referenced backdoor identified as CosmicPulse. The shift in tactics is intended to widen the phishing net and evade existing detection mechanisms.

What should defenders do?

Organizations should heighten phishing awareness and training, particularly for targets aligned with Ukrainian interests. Security teams are advised to monitor for indicators associated with the RedFlick tactic and the CosmicPulse backdoor. Implementation of robust email filtering and attachment scanning is recommended. No specific software patches are available for this activity.

highThreat Intelligence

Russia's Star Blizzard APT Adopts New "RedFlick" Phishing Tactic to Deploy CosmicPulse Backdoor

Actor shifts from ClickFix to target Ukrainian-linked NGOs, think tanks, and journalists with enhanced phishing campaigns

CyberIntel DeskPublished about 1 hour agoUpdated less than a minute ago1 min read

Russia's Star Blizzard APT Adopts New "RedFlick" Phishing Tactic to Deploy CosmicPulse Backdoor

Key Takeaways

Star Blizzard, a known Russian APT, has transitioned from ClickFix to a new tactic designated RedFlick.
The campaign targets Ukrainian-linked NGOs, think tanks, and journalists globally.
The objective is the deployment of the CosmicPulse backdoor to maintain access and enable data exfiltration.
The shift in tactics aims to widen the phishing net and evade existing detection.

Related Security News

highCyber Attacks

Star Blizzard Campaign Targets 100+ Organizations with Fake Event Invitations

Microsoft reports that the Russian state-sponsored threat actor Star Blizzard has been conducting a sustained campaign since January 2026, using fake event invitations to trick targets into installing a backdoor on Windows computers. The operation has affected more than 100 organizations, primarily in the U.S. and U.K., with victims tied to Ukraine. At least one infection has been confirmed, though the full extent of breaches and data exfiltration remains unverified.

The Hacker News1 day ago1 min read