Star Blizzard's RedFlick Evolution: How Russian APT Streamlined Phishing Attacks in 2026
Russia's Star Blizzard APT group has evolved its phishing tactics in 2026, abandoning the multi-step ClickFix technique for a streamlined approach called RedFlick. Since January 2026, the FSB-linked threat actor has conducted 13 large-scale phishing campaigns targeting Ukrainian-linked NGOs, think tanks, and journalists worldwide. RedFlick reduces victim interaction to a single click while deploying the CosmicPulse backdoor through scheduled tasks and legitimate Windows utilities, significantly increasing the success rate of initial compromise attempts. This incident highlights the accelerating evolution of state-sponsored phishing operations, where APT groups are prioritizing operational efficiency over surgical precision. As geopolitical tensions persist, organizations supporting Ukraine or conducting Russia-related research face increasingly sophisticated and scalable attack vectors that require enhanced email security and user awareness programs.
Kill Chain
