CYFIRMA Profiles Star Blizzard’s RedFlick Campaigns and Evolving Tradecraft
Summary
CYFIRMA profiles Star Blizzard's 2023–2026 espionage activity, detailing RedFlick delivery, malware and phishing, with hunting queries and mitigations. Microsoft reported at least 13 campaigns against 100+ organizations since January 2026; its broader-targeting assess
Key points
- The profile describes Star Blizzard targeting government and diplomatic staff, defense, policy groups, NGOs, academia and media; the UK and US are identified as its most targeted countries.
- Five Eyes governments assess that Star Blizzard is almost certainly subordinate to FSB Centre 18. Two alleged members were charged in the US; the charges are allegations.
- Microsoft reported at least 13 large-scale campaigns against over 100 organizations since January 2026. Its assessment that the group had broadened its targeting was at moderate confidence.
- RedFlick uses malicious VHDX files, compromised websites and scheduled tasks to deliver concealed payloads, including the CosmicPulse backdoor.
- The article says reported campaigns shifted from mainly credential and session-cookie theft to installing endpoint backdoors; new malware appeared five days after LOSTKEYS was exposed in May 2025.
- In reported March 2026 activity, Star Blizzard used the leaked DarkSword iOS exploit kit. The redirector, loader, remote-code-execution and PAC-bypass stages were observed, but delivery of sandbox-escape and kernel stages was not confirmed.
- The profile provides eight Microsoft Defender XDR hunting queries and prioritized mitigations, including phishing-resistant MFA, iOS updates, and blocking VHD/VHDX files and LNK files from unsolicited content.
Article Details
- Attack Vectors
- Spear-phishing using trusted-contact impersonation, relationship building, benign lures, and follow-up credential-harvesting links or password-protected archives.
- Fake professional or social media profiles and event-invitation lures, including WhatsApp group invitations that prompted QR-code device linking.
- Phishing sent through compromised cPanel and WordPress sites, used as senders and redirect infrastructure.
- Malicious VHDX files containing LNK files, plus scheduled tasks and concealed payloads, used in the RedFlick delivery chain.
- COLDCOPY fake-CAPTCHA lures that instructed targets to paste commands into the Run dialog.
- EvilGinx adversary-in-the-middle phishing used to capture mailbox credentials and session cookies.
- Reported delivery of the leaked DarkSword iOS exploit kit through a spoofed policy-institute invitation; delivery of sandbox-escape and kernel stages was not confirmed.
- Defensive Notes
- Enforce phishing-resistant MFA for high-risk staff and alert on sign-ins from new devices and token replay.
- Extend account-protection guidance to personal email and messaging accounts; have users review WhatsApp linked devices.
- Update iPhones to iOS 26.3 or later; consider Apple Lockdown Mode for the highest-risk users.
- Block mounting VHD and VHDX files delivered by email or download, strip LNK files from archives, and review unsolicited password-protected archives.
- Block outbound SSH from workstations and disable the WebDAV client where it is not needed.
- Alert on new scheduled tasks that launch control.exe, rundll32.exe, or Python from user profiles.
- Train staff to reject fake CAPTCHA pages that ask them to paste commands into the Run dialog.
- Monitor mailbox forwarding rules and unusual mailbox access from new IP addresses; use behavior-based detection because delivery components and indicators change.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | bpdaersa[.]click | RedFlick MSI-hosting domain reported for March 2026. |
| DOMAIN | byveo[.]org | RedFlick PowerShell-installer hosting domain reported for July 2026. |
| DOMAIN | cyrna[.]top | RedFlick MSI-hosting domain reported for August 2026. |
| DOMAIN | divekickspolic[.]org | Reported host for downloading the CosmicPulse backdoor. |
| DOMAIN | drasw[.]club | CosmicPulse downloader-hosting domain reported for August 2026. |
| DOMAIN | etia[.]ca | RedFlick MSI-hosting domain reported for January 2026. |
| DOMAIN | gliderrompercycl[.]com | Reported host for downloading the CosmicPulse backdoor. |
| DOMAIN | groy[.]cc | RedFlick MSI-hosting domain reported for February 2026. |
| DOMAIN | guach[.]net | RedFlick PowerShell-installer hosting domain reported for June 2026. |
| DOMAIN | itechx[.]tel | RedFlick MSI-hosting domain reported for April 2026; spelling preserved as published. |
| DOMAIN | matjk[.]click | RedFlick MSI-hosting domain reported for March 2026. |
| DOMAIN | muvb[.]net | RedFlick MSI-hosting domain reported for February 2026. |
| DOMAIN | qumel[.]link | CosmicPulse downloader-hosting domain reported for July 2026. |
| DOMAIN | ruten[.]observer | CosmicPulse downloader-hosting domain reported for June to July 2026. |
| DOMAIN | secure-dns-hub[.]com | CosmicPulse downloader-hosting domain reported for July 2026 and still active when Microsoft published its report. |
| DOMAIN | stuseamandesilt[.]org | Reported host for downloading the CosmicPulse backdoor. |
| IPV4 | 103[.]160[.]59[.]97 | CosmicPulse downloader-hosting IP reported for July 2026. |
| IPV4 | 103[.]245[.]231[.]248 | CosmicPulse downloader-hosting IP reported for January 2026. |
| IPV4 | 103[.]245[.]231[.]79 | CosmicPulse downloader-hosting IP reported for March 2026. |
| IPV4 | 2[.]57[.]241[.]246 | CosmicPulse downloader-hosting IP reported for February 2026. |
| IPV4 | 45[.]84[.]59[.]66 | CosmicPulse downloader-hosting IP reported for April 2026. |
| IPV4 | 89[.]125[.]209[.]168 | CosmicPulse downloader-hosting IP reported for February 2026. |
| SHA256 | 1f2096ff906915fbf80778f0636446206197351f7e271af97936eeb6f32c179d | SHA-256 of the Documents.vhdx file inside a RedFlick lure ZIP from January 2026. |
| SHA256 | 24b6e36a09eb2acfc2a95478ca685acb7593b1689be6a4a639fe0d222393cfa7 | SHA-256 of a password-protected RAR used in a roundtable-invitation lure in July 2026. |
| SHA256 | 2e74f6bd9bf73131d3213399ed2f669ec5f75392de69edf8ce8196cd70eb6aee | SHA-256 of the NOROBOT iamnotarobot.dll malware artifact from May 2025. |
| SHA256 | 699e92a9e0edf7835879d5697bc67138c0b137117f459caf1a44df357407cad9 | SHA-256 of a password-protected RAR used in a conference-invitation lure in June 2026. |
| SHA256 | 9707a8694e954e9ee13e839d6e5905ce626c0837c7c90da6d1025bfbe152866b | SHA-256 of Documents.zip, identified as a RedFlick lure from January 2026. |
| SHA256 | b60100729de2f468caf686638ad513fe28ce61590d2b0d8db85af9edc5da98f9 | SHA-256 of an obfuscated MAYBEROBOT malware artifact. |
| SHA256 | c4d0fba5aaafa40aef6836ed1414ae3eadc390e1969fdcb3b73c60fe7fb37897 | SHA-256 of a COLDCOPY fake-CAPTCHA lure. |
| SHA256 | dd98dbc1a55afe6fd0ed2ed53a79c76f6bde15081a0060422185b74eb1799ee4 | SHA-256 of Payment Advice Note.zip, identified as a RedFlick lure from August 2026. |
MITRE ATT&CK
T1053.005 · Scheduled TaskNOROBOT and RedFlick used scheduled tasks for persistence.T1059.001 · PowerShellMAYBEROBOT and a July 2026 RedFlick variant used PowerShell.T1059.006 · PythonYESROBOT and CosmicPulse were identified as Python backdoors.T1071.001 · Web ProtocolsHTTPS was reported as a command-and-control protocol.T1078 · Valid AccountsThe group used stolen mailbox credentials and session cookies to access accounts.T1204.002 · Malicious FileVictims were lured into opening an LNK disguised as a PDF inside a VHDX file or archive.T1204.004 · Malicious Copy and PasteCOLDCOPY fake-CAPTCHA lures prompted victims to paste commands into the Run dialog.T1456The reported March 2026 DarkSword iOS delivery involved a drive-by compromise chain.T1539 · Steal Web Session CookieEvilGinx captured web session cookies during credential-phishing campaigns.T1550.004 · Web Session CookieStolen session cookies were replayed to access mailboxes without re-authentication.T1557 · Adversary-in-the-MiddleEvilGinx phishing captured session cookies through adversary-in-the-middle activity and bypassed MFA.T1566.001 · Spearphishing AttachmentPassword-protected archives were sent as malicious follow-ups after an initial reply.T1566.002 · Spearphishing LinkStar Blizzard sent credential-phishing links after initial contact, including links to spoofed login pages.T1584.004 · ServerCompromised cPanel and WordPress sites were used to send phishing and redirect victims.T1676A January 2025 WhatsApp lure used QR-code device linking for account takeover.
Threat Actors
Andrey Stanislavovich KorinetsNamed as a suspected handler and charged by the US in connection with the group. The article states that the charges are allegations.BlueCharlieExplicitly identified as an alias of Star Blizzard, to which the article attributes malicious cyber activity.COLD RELICExplicitly identified as an alias of Star Blizzard, to which the article attributes phishing and malware campaigns.Ruslan Aleksandrovich PeretyatkoNamed as a suspected handler and alleged FSB Centre 18 officer; charged by the US in connection with the group. The article states that the charges are allegations.Star BlizzardThe article attributes persistent spear-phishing, credential and data theft, malware delivery, and espionage activity to the group; it reports that public attribution links it to FSB Centre 18.TAG-53Explicitly identified as an alias of Star Blizzard, to which the article attributes malicious cyber activity.
Malware
BAITSWITCHphishing kit; COLDCOPY fake-CAPTCHA (ClickFix) lure; LOSTKEYS; NOROBOT downloader (also BAITSWITCH); YESROBOT Python backdoor (also CosmicPulse); MAYBEROBOT PowerShell backdoor (also SIMPLEFIX);CosmicPulsephishing kit; COLDCOPY fake-CAPTCHA (ClickFix) lure; LOSTKEYS; NOROBOT downloader (also BAITSWITCH); YESROBOT Python backdoor (also CosmicPulse); MAYBEROBOT PowerShell backdoor (also SIMPLEFIX); RedFlick deliveryGHOSTBLADEbackdoor (also SIMPLEFIX); RedFlick delivery chain; leaked DarkSword iOS exploit kit with the GHOSTBLADE dataminer.LOSTKEYSSPICA backdoor; EvilGinx adversary-in-the-middle phishing kit; COLDCOPY fake-CAPTCHA (ClickFix) lure; LOSTKEYS; NOROBOT downloader (also BAITSWITCH); YESROBOT Python backdoor (also CosmicPulse); MAYBEROBOT PowerShellMAYBEROBOTlure; LOSTKEYS; NOROBOT downloader (also BAITSWITCH); YESROBOT Python backdoor (also CosmicPulse); MAYBEROBOT PowerShell backdoor (also SIMPLEFIX); RedFlick delivery chain; leaked DarkSword iOS exploit kit withNOROBOTEvilGinx adversary-in-the-middle phishing kit; COLDCOPY fake-CAPTCHA (ClickFix) lure; LOSTKEYS; NOROBOT downloader (also BAITSWITCH); YESROBOT Python backdoor (also CosmicPulse); MAYBEROBOT PowerShell backdoorSIMPLEFIX(also BAITSWITCH); YESROBOT Python backdoor (also CosmicPulse); MAYBEROBOT PowerShell backdoor (also SIMPLEFIX); RedFlick delivery chain; leaked DarkSword iOS exploit kit with the GHOSTBLADE dataminer.SPICASPICA backdoor; EvilGinx adversary-in-the-middle phishing kit; COLDCOPY fake-CAPTCHA (ClickFix) lure; LOSTKEYS; NOROBOT downloader (also BAITSWITCH); YESROBOT Python backdoor (also CosmicPulse); MAYBEROBOT PowerShell
Vendors
AppleMicrosoft Windows endpoints; Microsoft 365 and consumer webmail accounts (Proton, Gmail, Outlook, Yahoo); WhatsApp; Apple iOS.Googlemedia profiles; WhatsApp group-invitation lures (January 2025); links to file-sharing services (OneDrive, Google Drive, ProtonDrive). No presence on underground forums, Telegram or marketplaces has been reported, whichMicrosoftMicrosoft Windows endpoints; Microsoft 365 and consumer webmail accounts (Proton, Gmail, Outlook, Yahoo); WhatsApp; Apple iOS.
Products
GmailMicrosoft Windows endpoints; Microsoft 365 and consumer webmail accounts (Proton, Gmail, Outlook, Yahoo); WhatsApp; Apple iOS.iOSMicrosoft Windows endpoints; Microsoft 365 and consumer webmail accounts (Proton, Gmail, Outlook, Yahoo); WhatsApp; Apple iOS.Microsoft 365 Apps for EnterpriseMicrosoft Windows endpoints; Microsoft 365 and consumer webmail accounts (Proton, Gmail, Outlook, Yahoo); WhatsApp; Apple iOS.Microsoft WindowsMicrosoft Windows endpoints; Microsoft 365 and consumer webmail accounts (Proton, Gmail, Outlook, Yahoo); WhatsApp; Apple iOS.OutlookMicrosoft Windows endpoints; Microsoft 365 and consumer webmail accounts (Proton, Gmail, Outlook, Yahoo); WhatsApp; Apple iOS.ProtonMicrosoft Windows endpoints; Microsoft 365 and consumer webmail accounts (Proton, Gmail, Outlook, Yahoo); WhatsApp; Apple iOS.WhatsAppMicrosoft Windows endpoints; Microsoft 365 and consumer webmail accounts (Proton, Gmail, Outlook, Yahoo); WhatsApp; Apple iOS.YahooMicrosoft Windows endpoints; Microsoft 365 and consumer webmail accounts (Proton, Gmail, Outlook, Yahoo); WhatsApp; Apple iOS.
Tools
DarkSword(also CosmicPulse); MAYBEROBOT PowerShell backdoor (also SIMPLEFIX); RedFlick delivery chain; leaked DarkSword iOS exploit kit with the GHOSTBLADE dataminer.EvilginxSPICA backdoor; EvilGinx adversary-in-the-middle phishing kit; COLDCOPY fake-CAPTCHA (ClickFix) lure; LOSTKEYS; NOROBOT downloader (also BAITSWITCH); YESROBOT Python backdoor (also CosmicPulse); MAYBEROBOT PowerShell
Countries
CanadaKingdom and United States (most targeted); Ukraine; other NATO members and Russia’s neighbours, including Canada, Estonia, France, Germany, Greece, Italy, Latvia, Lithuania, Norway, Poland, Sweden and Switzerland;EstoniaUnited States (most targeted); Ukraine; other NATO members and Russia’s neighbours, including Canada, Estonia, France, Germany, Greece, Italy, Latvia, Lithuania, Norway, Poland, Sweden and Switzerland; RussianFranceStates (most targeted); Ukraine; other NATO members and Russia’s neighbours, including Canada, Estonia, France, Germany, Greece, Italy, Latvia, Lithuania, Norway, Poland, Sweden and Switzerland; Russian oppositionGermany(most targeted); Ukraine; other NATO members and Russia’s neighbours, including Canada, Estonia, France, Germany, Greece, Italy, Latvia, Lithuania, Norway, Poland, Sweden and Switzerland; Russian opposition figures,Polandneighbours, including Canada, Estonia, France, Germany, Greece, Italy, Latvia, Lithuania, Norway, Poland, Sweden and Switzerland; Russian opposition figures, independent media and exiles inside and outside theRussiaUnited Kingdom and United States (most targeted); Ukraine; other NATO members and Russia’s neighbours, including Canada, Estonia, France, Germany, Greece, Italy, Latvia, Lithuania, Norway, Poland, Sweden andUkraineUnited Kingdom and United States (most targeted); Ukraine; other NATO members and Russia’s neighbours, including Canada, Estonia, France, Germany, Greece, Italy, Latvia, Lithuania, Norway, Poland, Sweden andUnited KingdomUnited Kingdom and United States (most targeted); Ukraine; other NATO members and Russia’s neighbours, including Canada, Estonia, France, Germany, Greece, Italy, Latvia, Lithuania, Norway, Poland, Sweden andUnited StatesUnited Kingdom and United States (most targeted); Ukraine; other NATO members and Russia’s neighbours, including Canada, Estonia, France, Germany, Greece, Italy, Latvia, Lithuania, Norway, Poland, Sweden and
Industries
Academia and researchand the defence industrial base; think tanks and policy institutes; NGOs and civil society; academia and research; media; politicians; energy; intergovernmental bodies; and, in 2026, financial organisations,Defensehttps://media.defense.gov/2023/Dec/07/2003353251/-1/-1/0/ADVISORY-RUSSIAN-FSB-CYBER-ACTOR-STAR-BLIZZARD-CONTINUES-WORLDWIDE-SPEAR-SPHISHING-CAMPAIGNS.PDFEnergythink tanks and policy institutes; NGOs and civil society; academia and research; media; politicians; energy; intergovernmental bodies; and, in 2026, financial organisations, technology firms and hotels in Kyivfinanceover 100 organisations, mainly in the US and UK. Ukrainian targets first, then event-invitation and finance-themed lures internationally. Mailboxes on compromised websites used as senders from March 2026.GovernmentEspionage through credential and data theft against people of political interest. The UK Government also attributes hack-and-leak operations against UK politics to the group, including the leak of UK-US trade documentsHotelsenergy; intergovernmental bodies; and, in 2026, financial organisations, technology firms and hotels in KyivLegalZIP files. Targeting wider than usual: government, think tanks, higher education, finance and legal.MediaItaly, Latvia, Lithuania, Norway, Poland, Sweden and Switzerland; Russian opposition figures, independent media and exiles inside and outside the Russian Federation.NGOs and civil societyand diplomatic staff; defence and the defence industrial base; think tanks and policy institutes; NGOs and civil society; academia and research; media; politicians; energy; intergovernmental bodies; and, in 2026,politicspeople of political interest. The UK Government also attributes hack-and-leak operations against UK politics to the group, including the leak of UK-US trade documents before the 2019 general election.Technologyresearch; media; politicians; energy; intergovernmental bodies; and, in 2026, financial organisations, technology firms and hotels in KyivThink tanks and policy institutesGovernment and diplomatic staff; defence and the defence industrial base; think tanks and policy institutes; NGOs and civil society; academia and research; media; politicians; energy; intergovernmental bodies; and, in