ThreatPaper

#ukraine

3 cases

Star Blizzard's RedFlick technique delivers the CosmicPulse backdoor to 100+ organizations

Russia's FSB-linked Star Blizzard used a new delivery technique, RedFlick, in 13 phishing campaigns affecting 100+ US and UK organizations to deploy its CosmicPulse backdoor in 2026.

State-SponsoredSocial EngineeringMalware
GTG-20006: The Russian Espionage Crew That Used Claude to Rebuild Its Malware Every Time It Was Caught

Anthropic's September threat report describes a Midnight Blizzard-linked operator running eight AI workflows — phishing, hotel Wi-Fi hijack, malware evasion — against 24 targets in Ukraine and Europe. Microsoft's CaptiveCrunch report, from the other side, lists four of the same domains.

State-SponsoredAI & Machine Learning
GuardBreaker: Malware That Weaponises AI Safety Refusals to Block Its Own Analysis

Attackers put a request for nuclear weapon instructions inside a malicious script, not to attack anyone, but so an AI reviewing the code would refuse to read further. The defender's safety guardrail becomes the evasion.

MalwareState-SponsoredAI & Machine Learning