[CLSTR]
< Back to situations

Monitor this situation.

[SITUATION] · [ACTIVE] · [TECHNOLOGY]

2 clusters · 7 sources · 2 days · First seen · Last updated

Star Blizzard cyber espionage expansion

Overview

The Russian-linked hacking group Star Blizzard, also known as Callisto or ColdRiver, has significantly expanded its cyberattack operations. Moving away from exclusively targeted spear-phishing, the group has transitioned to larger-scale campaigns using automated mass-mailing platforms to reach hundreds of potential victims.

A central component of this expansion is the deployment of a new malware delivery technique called ‘RedFlick’. This method utilizes password-protected archives that execute background scripts to deploy malware such as NoroBot or BaitSwitch. The group has also been observed creating accounts on compromised websites to impersonate reputable organizations.

These operations have targeted over 100 organizations, primarily in the United States and the United Kingdom. The campaign focuses on government agencies, financial institutions, NGOs, and think tanks, with a notable emphasis on Ukrainian individuals and entities that provide political or financial support to Ukraine.

Entities

Star Blizzard · Federal Security Service · FSB · United States · Metropolitan Police Service

Timeline

  1. 2 days ago

    [TECHNOLOGY] 3 sources
    Star Blizzard hackers scale up phishing attacks using RedFlick technique

    Russian-linked hacking group Star Blizzard has scaled up phishing attacks using a new ‘RedFlick’ technique, targeting over 100 organizations in the US, UK, and Ukraine that support Ukrainian interests.

  2. 4 days ago

    [TECHNOLOGY] 4 sources
    Microsoft reports expansion of Star Blizzard phishing and disruption of AI-driven EvilTokens

    Microsoft reports that Russian-linked Star Blizzard has expanded phishing via new malware, while the AI-powered cybercrime service EvilTokens has been disrupted following thousands of email breaches.

Sources

archynewsy.com · campustechnology.com · cybernoz.com · cyberscoop.com · datasecuritybreach.fr · independent.co.uk · therecord.media