Star Blizzard advances phishing and malware with RedFlick technique
Since early 2026, Microsoft has tracked Russian state actor Star Blizzard using enhanced phishing and a new malware delivery method called RedFlick, improving their evasion capabilities.
Why it matters
Understanding the RedFlick technique provides critical insight into evolving state-sponsored attack methods, enabling more effective detection and mitigation of these sophisticated threats.
SOC impact
Defenders should prioritize detection of phishing attempts and analyze malware delivery patterns specific to the RedFlick technique. Monitoring for these indicators enhances the ability to identify and respond to campaigns by Star Blizzard.
Recommended actions
- Identify phishing campaigns potentially linked to Star Blizzard
- Analyze malware delivery methods consistent with RedFlick
- Monitor for suspicious payloads and evasion behaviors
- Review telemetry for signs of novel attack delivery techniques
- Investigate alerts related to state-sponsored threat activity
Executive Summary
Microsoft has observed the Russian state-sponsored actor Star Blizzard refining its phishing capabilities and introducing a novel malware delivery technique named RedFlick since early 2026. This advancement enhances the actor’s ability to evade traditional detection methods, reflecting a continued evolution in their cyber campaign sophistication. Security teams must recognize the operational significance of these developments to adapt detection, monitoring, and response efforts accordingly.
SOC Impact
Defenders should prioritize detection of phishing attempts and analyze malware delivery patterns specific to the RedFlick technique. Monitoring for these indicators enhances the ability to identify and respond to campaigns by Star Blizzard.
Phishing and Malware Delivery Validation
- Identify phishing campaigns potentially linked to Star Blizzard
- Analyze malware delivery methods consistent with RedFlick
- Monitor for suspicious payloads and evasion behaviors
- Review telemetry for signs of novel attack delivery techniques
- Investigate alerts related to state-sponsored threat activity
Why It Matters
Understanding the RedFlick technique provides critical insight into evolving state-sponsored attack methods, enabling more effective detection and mitigation of these sophisticated threats.