Indicators are what attackers leave behind. Stolen credentials are what they arrive with.
30 IOCs
Star Blizzard Refines Phishing and Malware Delivery with the Redflick Technique
Threat Actors
Excerpt
https://www.microsoft.com/en-us/security/blog/2026/09/29/star-blizzard-refines-phishing-and-malware-delivery-with-the-redflick-technique/ Star Blizzard refines phishing and malware delivery with the RedFlick technique By Microsoft Threat Intelligence Published: 2026-09-29 · Archived: 2026-10-10 02:01:21 UTC Since January 2026, Microsoft has observed Russian state threat actor Star Blizzard evolve their detection evasion capabilities through large-scale phishing campaigns, the…
Read the original report →Diamond Model
Adversary(5)
Infrastructure(6)
Capability
Victim
Indicators of Compromise
Open the mindmap →30 indicators
| Type | Indicator | Confidence | Score | First Seen |
|---|---|---|---|---|
| SHA256 | dd98dbc1a55afe6fd0ed2ed53a79c76f6bde15081a0060422185b74eb1799ee4 | High | Score 61/100 | First seen |
| SHA256 | 699e92a9e0edf7835879d5697bc67138c0b137117f459caf1a44df357407cad9 | High | Score 61/100 | First seen |
| Domain | note.zip | High | Score 67/100 | First seen |
| Domain | gliderrompercycl.com | High | Score 64/100 | First seen |
| URL | https://dslua.org/publications/spearphishing-via-fake-urc-2026-invitations-targets-ukrainian-csos/ | High | Score 67/100 | First seen |
| Domain | cyrna.top | High | Score 64/100 | First seen |
| Domain | groy.cc | High | Score 64/100 | First seen |
| IP | 103.160.59.97 | High | Score 64/100 | First seen |
| Domain | qumel.link | High | Score 64/100 | First seen |
| SHA256 | 24b6e36a09eb2acfc2a95478ca685acb7593b1689be6a4a639fe0d222393cfa7 | High | Score 61/100 | First seen |
| Domain | muvb.net | High | Score 64/100 | First seen |
| IP | 89.125.209.168 | High | Score 64/100 | First seen |
| IP | 103.245.231.79 | High | Score 64/100 | First seen |
| Domain | etia.ca | High | Score 64/100 | First seen |
| Domain | divekickspolic.org | High | Score 64/100 | First seen |
| Domain | stuseamandesilt.org | High | Score 64/100 | First seen |
| IP | 45.84.59.66 | High | Score 64/100 | First seen |
| SHA256 | 9707a8694e954e9ee13e839d6e5905ce626c0837c7c90da6d1025bfbe152866b | High | Score 61/100 | First seen |
| Domain | bpdaersa.click | High | Score 64/100 | First seen |
| SHA256 | 1f2096ff906915fbf80778f0636446206197351f7e271af97936eeb6f32c179d | High | Score 61/100 | First seen |
| Domain | ruten.observer | High | Score 64/100 | First seen |
| Domain | byveo.org | High | Score 64/100 | First seen |
| Domain | secure-dns-hub.com | High | Score 64/100 | First seen |
| Domain | ukr.net | High | Score 70/100 | First seen |
| Domain | guach.net | High | Score 64/100 | First seen |
| Domain | matjk.click | High | Score 64/100 | First seen |
| Domain | drasw.club | High | Score 64/100 | First seen |
| IP | 2.57.241.246 | High | Score 64/100 | First seen |
| Domain | itechx.tel | High | Score 64/100 | First seen |
| IP | 103.245.231.248 | High | Score 64/100 | First seen |
IOC Relationship Graph
Building graph…