State-Linked Russian Hackers Deploy RedFlick Phishing Scheme Against More Than a Hundred Firms

Russian hackers with alleged ties to the Kremlin have broadened a phishing campaign that now targets more than a hundred organizations, according to cybersecurity analysts who first reported the activity. The operation, dubbed “RedFlick,” replaces the traditional malicious attachment with a seemingly innocuous email conversation, making the lure harder to spot.

RedFlick’s delivery chain begins with a legitimate‑looking email thread that mimics routine professional correspondence. Instead of a suspicious file, the message contains a link or a short snippet that, when clicked, redirects the victim to a compromised web page hosting the payload. By embedding the malicious code within a familiar dialogue, the attackers aim to bypass both user skepticism and automated security filters that flag obvious attachments.

Researchers say the campaign’s reach spans a diverse set of sectors, from financial services and technology firms to government contractors and healthcare providers. While the exact list of victims remains confidential, the breadth of the operation suggests the attackers are pursuing a broad intelligence‑gathering or credential‑stealing agenda rather than a narrowly focused espionage effort.

Security experts highlight the shift as a sign of growing sophistication among state‑affiliated threat actors. Traditional phishing emails often rely on overt signs—such as misspellings or obvious malware‑laden files—that can be caught by vigilant users or email security gateways. By embedding the malicious element within a realistic dialogue, RedFlick reduces the chance of detection and increases the likelihood that recipients will engage with the content.

The campaign was first identified by a cybersecurity news outlet, which noted that the new delivery method replaces “an obvious malicious attachment with a conversation that looks like ordinary professional correspondence.” Subsequent analysis by independent security firms confirmed the pattern and traced the infrastructure to servers previously linked to Russian‑state sponsored groups.

Defenders advise organizations to reinforce basic hygiene measures: verify unexpected requests through alternative channels, employ robust email authentication protocols such as DMARC, and ensure that multi‑factor authentication is enforced for privileged accounts. Endpoint detection and response tools that can flag anomalous behavior after a link is clicked are also recommended.

Law enforcement and intelligence agencies are reportedly monitoring the RedFlick operation, though attribution remains a complex process that requires corroborating technical evidence with geopolitical context. Analysts expect the attackers to iterate on the technique, potentially adding deeper layers of obfuscation or targeting supply‑chain partners to amplify the impact.

As phishing continues to evolve, the RedFlick episode underscores the importance of continuous user education and adaptive security controls. Organizations that treat email as a frontline defense, rather than a peripheral concern, will be better positioned to mitigate the risk posed by increasingly covert campaigns.