A change in delivery
Microsoft reported September 29 that Star Blizzard has expanded its phishing operations and adopted a malware-delivery technique it calls RedFlick. The company describes scheduled tasks used to deploy the CosmicPulse backdoor, with fewer required user actions than earlier ClickFix-style chains. Its research links the activity to cyberespionage targeting Ukrainian and international organizations associated with policy and support for Ukraine.
The conversation is part of the lure
The report describes initial contact followed by a malicious attachment, including password-protected archives. Conference invitations and other professional themes feature in the observed campaigns. Microsoft also reports use of email accounts on compromised websites. These findings mean a plausible subject, a prior reply and a real organizational domain cannot independently establish that an attachment is safe.
For newsrooms and public-sector teams
Our operational recommendation is to build verification into the work that already happens around invitations. A newsroom arranging an interview or conference appearance should confirm an unexpected archive through a known contact route, especially when it arrives as a supposedly omitted attachment. Government and defense policy teams can use the same approach for external roundtables. This is a targeted workflow precaution, not a claim that every invitation or password-protected file is malicious.
Make reporting easier than improvising
The help desk should give staff a quick way to submit the message and explain what happened without reopening the attachment. Preserve the original email and related conversation when practical. Security teams can compare execution and scheduled-task activity with the vendor’s published indicators, while accounting for authorized software. Managers should make clear that reporting an interaction promptly is useful even if the employee already replied. A training program that stops at identifying bad grammar misses a campaign built around credible professional relationships. The more useful exercise is to rehearse a believable invitation, an unexpected follow-up and a clear path to verification.
Sources & further reading
Our practical suggestions are editorial guidance. Verify applicability against current source and vendor instructions.
