Act
archived
Star Blizzard deploys RedFlick malware delivery technique in active phishing campaign
- Engineer — Learn: RedFlick is a novel malware delivery technique, not a patchable CVE; useful for understanding evasion tradecraft that may bypass current email and endpoint controls, but no specific infrastructure change is required today.
- SOC/IR — Act: Star Blizzard’s active large-scale phishing campaign with the RedFlick delivery technique has been running since January 2026; pull the full Microsoft post for IOCs and ATT&CK TTP mappings, then hunt for RedFlick-associated lures in email gateway logs and sweep endpoint telemetry for associated malware staging behaviors.
- Leader — Learn: Russian state actor Star Blizzard has evolved its evasion and delivery capabilities; file as threat-landscape context and flag for a targeted-sector check — if your organization operates in government, defense, or policy circles, consider a brief to security leadership on exposure.
This entry was curated and judged by AI (Claude) with automated enrichment
(CISA KEV / EPSS / public PoC). Verify against the original source before
acting. Found a bad verdict?
Report it —
confirmed errors go to the corrections log.