A Russia-linked advanced persistent threat (APT) actor that was significantly disrupted by Microsoft and US officials two years ago is casting a wider net than ever with its phishing and malware-delivery tactics. In recent attacks, the nation-state actor has ditched its previous ClickFix strategy for a novel technique, allowing it to reach even more targets and evade detection.
Star Blizzard, active since 2017 and known for targeting journalists, nongovernmental organizations (NGOs), and Russia experts — particularly those supporting Ukraine — has since January demonstrated a key tactical change in its phishing initial-access method, Microsoft Threat Intelligence (MTI) revealed in a blog post on Sept. 29.
"As part of this evolution, Star Blizzard adopted RedFlick, a malware delivery technique that helps evade detection by initiating a set of scheduled tasks to deploy the actor's custom backdoor, CosmicPulse," according to MTI's post.
The technique signals a departure from the actor's previous use of the social engineering tactic ClickFix, which required several actions by the victim before deploying CosmicPulse, a Python-based backdoor, Microsoft said. "By contrast, the RedFlick infection flow only requires a single user interaction, reducing friction in the compromise process," according to the post.
This change, combined with the actor's shift toward large-scale phishing operations during the same period, likely increases the APT's chance of success, Microsoft warned, which should put organizations typically in Star Blizzard's crosshairs on alert.