Threat Intelligence Brief
Curated summary with source attribution
Source: thehackernews.com
Threat Risk: High
Victim: Government-linked organizations and think tanks
Incident: A state-sponsored phishing campaign delivering backdoors and mobile exploits to over 100 organizations.
Impact: Unauthorized access to sensitive organizational data and potential compromise of diplomatic communications.
Attacker: Star Blizzard (Russian FSB)
Analysis: The campaign utilizes a sophisticated delivery chain, evolving from simple phishing to using compromised WordPress sites and a technique called RedFlick to establish persistence via scheduled tasks. Attackers target high-value individuals with lures posing as NGOs and think tanks, delivering either the CosmicPulse Windows backdoor or the DarkSword iOS exploit kit. The use of Evilginx for session cookie theft further allows the actors to bypass multi-factor authentication.
Recommendations: Update iOS devices to version 26.3 or later and enable Lockdown Mode for high-risk targets.; Monitor for unauthorized Windows scheduled tasks and the execution of suspicious LNK or MSI files.; Verify event invitations through official, out-of-band communication channels before opening attachments.
Source: The Hacker News
Editorial note: this post summarizes third-party reporting and links to the original source.
View Original Source