Russian state hackers use new RedFlick technique to push malware
2026-10-01T07:23:21Z•79a7a68320eac1e411675ab31332c82a1ea05916a5fa65e8bc2bd2851c1224e9
CVE-2026-76504CVE-2026-88772Cisco Catalyst SD-WAN ManagerCitrix NetScalerClickFixCosmicPulseGitHub secretsMikroTik RouterOSRAT malwareRedFlickRussian threat actorStar BlizzardTeamViewerZammadactive exploitationauthentication bypassbusiness email compromisecredential exposurecritical vulnerabilitiescryptocurrency theftmalware deploymentphishingprivilege escalationremote code executionstate-sponsored hackingweb shellszero-day
What happened
BleepingComputer security feed covering active exploitation of critical and zero-day vulnerabilities, state-sponsored malware deployment, credential exposure, phishing and ClickFix malware delivery, ransomware/extortion activity, and security advisories across Cisco SD-WAN, Citrix NetScaler, MikroTik RouterOS, TeamViewer, Zammad, and third-party security products. Multiple reports describe real-world compromise, privilege escalation, remote code execution, web-shell deployment, credential theft, and major financial loss.
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- bleepingcomputer
- Record identifier
- 79a7a68320eac1e411675ab31332c82a1ea05916a5fa65e8bc2bd2851c1224e9
- Enrichment time
- 2026-10-01T07:23:21Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.