<![CDATA[Russian state hackers use new RedFlick technique to push malware]]>Star Blizzard, a threat actor tied to Russian state interests, has adopted a new malware delivery method called RedFlick to distribute its CosmicPulse backdoor. The technique is the latest evolution in the group's ongoing campaign against targeted victims.

According to reporting, the RedFlick method allows the attackers to stealthily install the backdoor, likely by exploiting trusted system utilities or delivery mechanisms to evade detection. This marks a shift from previously observed tactics attributed to Star Blizzard.

Key details on the campaign:

  • The actor involved is Star Blizzard, a Russian state-sponsored group.
  • The new installation technique is named RedFlick.
  • The payload delivered is the CosmicPulse backdoor.
  • The technique is described as a novel malware installation tactic.

At this time, no specific CVE identifier, KB number, or advisory ID has been provided in connection with this technique. Defenders should monitor for unusual activity consistent with CosmicPulse infections and review their exposure to known Star Blizzard tradecraft.

Source: BleepingComputer

Has your organization observed any indicators consistent with RedFlick or CosmicPulse activity, and how are you adapting your detection strategy?

]]>https://xploitlk.com/topic/522/russian-state-hackers-use-new-redflick-technique-to-push-malwareRSS for NodeTue, 27 Oct 2026 08:15:50 GMTWed, 30 Sep 2026 22:30:19 GMT60