Star Blizzard Uses RedFlick Technique to Deliver CosmicPulse Malware
Summary
Microsoft details Star Blizzard’s 2026 shift to larger phishing campaigns and RedFlick delivery, using scheduled tasks, VHDX files, and payloads hidden in PDFs to install the CosmicPulse backdoor against more than 100 organizations.
Key points
- Microsoft observed at least 13 large-scale campaigns since January 2026, affecting more than 100 organizations, mainly in the US and UK.
- Targets included Ukrainian individuals and institutions, NGOs, think tanks, government bodies, and financial organizations associated with support for Ukraine.
- The Russia-attributed Star Blizzard used compromised websites to create sender accounts and sent password-protected RAR or ZIP attachments after recipients replied to initial emails.
- RedFlick uses scheduled tasks to deliver CosmicPulse, a Python backdoor; the technique reduces the user interaction previously required by ClickFix-based chains.
- Delivery methods included malicious VHDX files, disguised LNK files, remote MSI and CPL payloads, and PowerShell commands concealed in PDFs.
- Microsoft provides detection guidance, hunting queries, indicators of compromise, and recommendations including phishing-resistant authentication, email protections, and endpoint monitoring.
Article Details
- Attack Vectors
- Large-scale phishing campaigns impersonated Ukrainian authorities, trusted contacts, or organizations and used lures themed as tax notices, fines, conferences, and other events.
- After recipients responded to initial contact, follow-up emails delivered password-protected RAR or ZIP archives containing files that initiated the RedFlick infection flow.
- A VHDX delivered in a password-protected ZIP contained an LNK disguised as a PDF, a BAT script, and a decoy PDF. The LNK launched commands that downloaded and executed an MSI installer.
- In July, an LNK used conhost.exe and curl to download a PDF from an actor-controlled server; a PowerShell payload extracted encoded data from the PDF and executed the decoded command.
- MSI installers created scheduled tasks for persistence, including tasks that accessed remote payloads through WebDAV or used control.exe to run a remotely hosted CPL applet.
- Star Blizzard used accounts created on compromised CPanel- and WordPress-hosted websites to send phishing emails.
- A campaign observed in mid-August used steganography to conceal identifiers.
- Defensive Notes
- Use phishing-resistant authentication and Conditional Access policies; consider requirements such as compliant devices or trusted IP addresses.
- Use anti-phishing protections, Safe Links, and Safe Attachments; recheck links at click time and enable Zero-hour auto purge for Defender for Office 365.
- Run endpoint detection and response in block mode, enable real-time and cloud-delivered protection, and configure automated investigation and remediation.
- Enable network protection and use firewall controls to restrict unnecessary outbound SSH connections to external or public networks.
- Monitor suspicious sign-ins and anomalous activity, including unusual locations, ISPs, user agents, or anonymizer use.
- Train users to verify unexpected senders through trusted contact methods, scrutinize email addresses and unsolicited attachments, and avoid disclosing credentials through unsolicited links.
- Use attack surface reduction rules to block untrusted executable files and potentially obfuscated scripts.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | bpdaersa[.]click | Host for the RedFlick MSI installer in the March 2026 campaign. |
| DOMAIN | byveo[.]org | Host for the RedFlick PowerShell code installer in the July 2026 campaign. |
| DOMAIN | cyrna[.]top | Host for the RedFlick MSI installer in the August 2026 campaign. |
| DOMAIN | divekickspolic[.]org | Host for the CosmicPulse backdoor download. |
| DOMAIN | drasw[.]club | Host for the CosmicPulse downloader DLL in the August 2026 campaign. |
| DOMAIN | etia[.]ca | Host for the RedFlick MSI installer in the January 2026 campaign. |
| DOMAIN | gliderrompercycl[.]com | Host for the CosmicPulse backdoor download. |
| DOMAIN | groy[.]cc | Host for the RedFlick MSI installer in the February 2026 campaign. |
| DOMAIN | guach[.]net | Host for the RedFlick PowerShell code installer in the June 2026 campaign. |
| DOMAIN | itechx[.]tel | Host for the RedFlick MSI installer in the April 2026 campaign. |
| DOMAIN | matjk[.]click | Host for the RedFlick MSI installer in the March 2026 campaign. |
| DOMAIN | muvb[.]net | Host for the RedFlick MSI installer in the February 2026 campaign. |
| DOMAIN | qumel[.]link | Host for the CosmicPulse downloader DLL in the July 2026 campaign. |
| DOMAIN | ruten[.]observer | Host for the CosmicPulse downloader DLL in the June–July 2026 campaigns. |
| DOMAIN | secure-dns-hub[.]com | Host for the CosmicPulse downloader DLL in July 2026 and later campaigns. |
| DOMAIN | stuseamandesilt[.]org | Host for the CosmicPulse backdoor download. |
| IPV4 | 103[.]160[.]59[.]97 | Host for the CosmicPulse downloader DLL in the July 2026 campaign. |
| IPV4 | 103[.]245[.]231[.]248 | Host for the CosmicPulse downloader DLL in the January 2026 campaign. |
| IPV4 | 103[.]245[.]231[.]79 | Host for the CosmicPulse downloader DLL in the March 2026 campaign. |
| IPV4 | 2[.]57[.]241[.]246 | Host for the CosmicPulse downloader DLL in the February 2026 campaign. |
| IPV4 | 45[.]84[.]59[.]66 | Host for the CosmicPulse downloader DLL in the April 2026 campaign. |
| IPV4 | 89[.]125[.]209[.]168 | Host for the CosmicPulse downloader DLL in the February 2026 campaign. |
| SHA256 | 1f2096ff906915fbf80778f0636446206197351f7e271af97936eeb6f32c179d | Malicious VHDX file named Documents.vhdx, contained in the identified January campaign ZIP attachment. |
| SHA256 | 24b6e36a09eb2acfc2a95478ca685acb7593b1689be6a4a639fe0d222393cfa7 | Password-protected RAR phishing attachment used in the July campaign. |
| SHA256 | 699e92a9e0edf7835879d5697bc67138c0b137117f459caf1a44df357407cad9 | Password-protected RAR phishing attachment used in the June campaign. |
| SHA256 | 9707a8694e954e9ee13e839d6e5905ce626c0837c7c90da6d1025bfbe152866b | Password-protected ZIP attachment named Documents.zip observed in the January campaign against Ukraine. |
| SHA256 | dd98dbc1a55afe6fd0ed2ed53a79c76f6bde15081a0060422185b74eb1799ee4 | Password-protected ZIP phishing attachment used in the August campaign. |
MITRE ATT&CK
T1027 · Obfuscated Files or InformationThe article describes obfuscated PowerShell, an encrypted CosmicPulse payload, and payload data concealed within a PDF.T1027.003 · SteganographyA mid-August campaign used steganography to conceal identifiers.T1041 · Exfiltration Over C2 ChannelA scheduled task sent the infected device's network or computer name and username to the C2 server.T1053.005 · Scheduled TaskMSI installers created scheduled tasks used for persistence and to execute or support remote payload delivery.T1059.001 · PowerShellPowerShell payloads extracted encoded data from a PDF and executed the decoded command; obfuscated PowerShell also attempted to create scheduled tasks.T1059.003 · Windows Command ShellThe LNK-launched chain used cmd.exe to execute an embedded BAT script.T1105 · Ingress Tool TransferCommands and scheduled tasks downloaded MSI installers, PDFs, CosmicPulse components, and other payloads from remote hosts.T1140 · Deobfuscate/Decode Files or InformationThe bootstrapper recovered an encrypted key and decoded the CosmicPulse payload; another chain extracted Base64 data from a PDF and decoded it for execution.T1204.002 · Malicious FileRecipients had to open malicious LNK files, including LNK files disguised as PDFs, to start the execution chain.T1218.002 · Control PanelThe actor used control.exe to execute a remotely hosted CPL applet masquerading as a Control Panel component.T1566.001 · Spearphishing AttachmentPhishing emails delivered password-protected ZIP or RAR attachments containing files that initiated the infection flow.T1566.002 · Spearphishing LinkThe article describes phishing links, including a campaign link leading to DarkSword installation and prior links to credential-theft infrastructure.
Threat Actors
Malware
BAITSWITCHThe downloader is also known publically as NOROBOT or BAITSWITCH.CosmicPulseAs part of this evolution, Star Blizzard adopted RedFlick, a malware delivery technique that helps evade detection by initiating a set of scheduled tasks to deploy the actor’s custom backdoor, CosmicPulse.DarkSwordRespondents received a link to DarkSword iOS backdoor installation.NOROBOTThe downloader is also known publically as NOROBOT or BAITSWITCH.YESROBOTkey in AES-ECB mode, and then uses the recovered key to decode the CosmicPulse payload (also known as YESROBOT) contained in the second ZIP file.
Vendors
Products
cPanelIn the large-scale campaigns, Star Blizzard has used accounts created on websites hosted on CPanel and WordPress, using the same account name across multiple website domains.Microsoft Defender Antivirusartifacts, even when your non-Microsoft antivirus does not detect the threat, or when Microsoft Defender Antivirus is running in passive mode.Microsoft Defender for EndpointRun endpoint detection and response (EDR) in block mode so that Microsoft Defender for Endpoint can block malicious artifacts, even when your non-Microsoft antivirus does not detect the threat, or when MicrosoftMicrosoft Defender for Office 365Use advanced anti-phishing solutions like Microsoft Defender for Office 365 that monitor and scan incoming emails and visited websites.Microsoft Defender XDRMicrosoft Defender XDR customers can use the following threat analytics reports in the Defender portal (requires license for at least one Defender XDR product) to get the most up-to-date information about the threatMicrosoft EdgeEncourage users to use Microsoft Edge and other web browsers that support Microsoft Defender SmartScreen, which identifies and blocks malicious websites, including phishing sites, scam sites, and sites that host malware.Microsoft Security CopilotMicrosoft Security CopilotMicrosoft SentinelMicrosoft SentinelWordPressIn the large-scale campaigns, Star Blizzard has used accounts created on websites hosted on CPanel and WordPress, using the same account name across multiple website domains.
Tools
Countries
Russiahttps://cloud.google.com/blog/topics/threat-intelligence/new-malware-russia-coldriverUkraineother organizations associated with international policy—particularly those with a nexus in supporting Ukraine.United KingdomMicrosoft has observed this activity affect over 100 organizations primarily in the United States and United Kingdom, consistent with Star Blizzard’s longstanding targeting priorities.United StatesStar Blizzard is attributed by the United States Cybersecurity and Infrastructure Agency (CISA) as subordinate to the Russian Federal Security Service Centre (FSB) Centre 18.
Industries
Academia“Invitation to an IISS [Private Roundtable/Closed-Door Discussion] on European Security” – Initial contact campaign targeting government officials, security researchers, academia, media, and NGOs.Financial institutionsindividuals and institutions, as well as international NGOs, think tanks, governments, and financial institutions that have supported Ukraine politically or financially.Governmentcyberespionage activity targeting Ukrainian individuals and institutions as well as international non-government organizations (NGOs), Western think tanks, governments, and other organizations associated withMedia“Invitation to an IISS [Private Roundtable/Closed-Door Discussion] on European Security” – Initial contact campaign targeting government officials, security researchers, academia, media, and NGOs.Non-governmental organizationsTechnology“Invitation to a Closed CES Roundtable Discussion” – Initial contact campaign targeting US and Europe technology-sector organizations.Think tanksindividuals and institutions as well as international non-government organizations (NGOs), Western think tanks, governments, and other organizations associated with international policy—particularly those with a