Executive Summary
Between June and September 2026, a series of coordinated spearphishing campaigns targeted media outlets, civil society organizations, and government officials in Moldova and Ukraine. These attacks, which share high technical overlap with the 'RedFlick' technique attributed to the Russian state-linked actor Star Blizzard, utilize a 'conversation-first' approach to bypass automated email security. Attackers impersonate European donor organizations and high-profile political figures, initially sending clean emails to establish trust before delivering malicious payloads upon request.
The technical workflow involves the delivery of password-protected ZIP archives containing Windows virtual disk images (VHDX). This method is specifically designed to bypass 'Mark of the Web' (MotW) protections and conventional security scanners. Once mounted, a disguised shortcut (.lnk) initiates a multi-stage execution chain that establishes persistence via recurring scheduled tasks. These tasks utilize WebDAV and control.exe to load remote DLLs from attacker-controlled infrastructure, effectively creating a persistent, fileless command channel.
The impact is significant for non-governmental organizations and international partners focused on regional security and post-war recovery. The shift toward selective delivery—only providing the payload after human interaction—demonstrates an evolution in adversary tradecraft aimed at evading automated sandbox analysis and detection.