A Russian advanced persistent threat group, known as Star Blizzard, has shifted its tactics by introducing a new method called 'RedFlick.' This approach targets Ukrainian-linked organizations, including NGOs, think tanks, and journalists, to deploy a malicious backdoor known as CosmicPulse. This change in strategy allows attackers to expand their phishing efforts, increasing the risk for individuals and organizations connected to Ukraine. The move is particularly concerning given the ongoing conflict and the vulnerability of these groups to cyber attacks. As this situation develops, it is crucial for affected parties to remain vigilant against potential phishing attempts and other cyber threats.