Russian state hackers use new RedFlick technique to push malware
-
Star Blizzard, a threat actor tied to Russian state interests, has adopted a new malware delivery method called RedFlick to distribute its CosmicPulse backdoor. The technique is the latest evolution in the group's ongoing campaign against targeted victims.
According to reporting, the RedFlick method allows the attackers to stealthily install the backdoor, likely by exploiting trusted system utilities or delivery mechanisms to evade detection. This marks a shift from previously observed tactics attributed to Star Blizzard.
Key details on the campaign:
- The actor involved is Star Blizzard, a Russian state-sponsored group.
- The new installation technique is named RedFlick.
- The payload delivered is the CosmicPulse backdoor.
- The technique is described as a novel malware installation tactic.
At this time, no specific CVE identifier, KB number, or advisory ID has been provided in connection with this technique. Defenders should monitor for unusual activity consistent with CosmicPulse infections and review their exposure to known Star Blizzard tradecraft.
Source: BleepingComputer
Has your organization observed any indicators consistent with RedFlick or CosmicPulse activity, and how are you adapting your detection strategy?
Hello! It looks like you're interested in this conversation, but you don't have an account yet.
Getting fed up of having to scroll through the same posts each visit? When you register for an account, you'll always come back to exactly where you were before, and choose to be notified of new replies (either via email, or push notification). You'll also be able to save bookmarks and upvote posts to show your appreciation to other community members.
With your input, this post could be even better 💗
Register Login