Star Blizzard Uses RedFlick to Deploy CosmicPulse Backdoor Through Phishing
Summary
Microsoft says Star Blizzard’s RedFlick campaign uses phishing and malicious archives to install the CosmicPulse backdoor, targeting more than 100 organizations, including groups supporting Ukraine.
Key points
- Phishing emails lead victims to password-protected archives containing a VHDX image with an LNK file disguised as a PDF.
- Opening the shortcut starts a staged infection chain that downloads and runs an MSI installer.
- The installer creates three scheduled tasks that support remote access and payload execution while helping evade detection.
- The NOROBOT and BAITSWITCH downloaders fetch and execute the CosmicPulse backdoor.
- Microsoft observed at least 13 large-scale phishing campaigns since the start of the year, affecting more than 100 organizations.
- Targets include Ukrainian individuals and institutions, NGOs, think tanks, governments, and financial institutions supporting Ukraine.
- Microsoft recommends phishing-resistant authentication, email protection, verification of suspicious messages, and EDR in block mode.
Article Details
- Attack Vectors
- Phishing messages impersonating trusted contacts or organizations, followed by password-protected ZIP or RAR archives containing a VHDX image.
- A PDF-disguised LNK file inside the VHDX launches a hidden command while showing a decoy PDF; the command downloads and runs an MSI installer.
- The installer creates scheduled tasks that send system and user information, prepare WebDAV access, and execute a remotely hosted next-stage payload.
- The NOROBOT/BAITSWITCH downloader is delivered as a Control Panel applet, fetches ZIP archives, and stages the CosmicPulse backdoor.
- CosmicPulse can execute attacker-supplied Python code to download and run files or retrieve documents from infected systems.
- Defensive Notes
- Use phishing-resistant authentication, Conditional Access policies, and email protection.
- Independently verify suspicious messages through established contact details.
- Use endpoint detection and response solutions in block mode to prevent execution of malicious artifacts.
MITRE ATT&CK
T1005 · Data from Local SystemCosmicPulse can retrieve documents from infected systems.T1027 · Obfuscated Files or InformationThe LNK file is disguised as a PDF and launches a hidden command while displaying a decoy PDF.T1053.005 · Scheduled TaskThe MSI installer creates three Windows scheduled tasks to perform distinct parts of the infection chain.T1059.006 · PythonCosmicPulse can execute attacker-supplied Python code to download and run files or retrieve documents.T1071.001 · Web ProtocolsThe article says the initial scheduled task sends the computer/network name and username to the attackers; it does not specify the protocol.T1105 · Ingress Tool TransferRedFlick components download an MSI installer, later payloads, ZIP archives, and files for execution.T1546.008 · Accessibility FeaturesThe next-stage downloader is delivered as a Control Panel applet (.cpl).T1566.001 · Spearphishing AttachmentStar Blizzard starts RedFlick infections with phishing emails, including messages impersonating trusted contacts or organizations.
Threat Actors
Malware
Vendors
Products
Countries
UkraineThe campaign uses phishing emails, malicious archives, and staged payloads to target organizations supporting Ukraine, as well as NGOs, think tanks, governments, and financial institutions.United KingdomThe company says that since the beginning of the year, it has observed at least 13 distinct large-scale phishing campaigns impacting more than 100 organizations, primarily in the United States and the United Kingdom.United StatesThe company says that since the beginning of the year, it has observed at least 13 distinct large-scale phishing campaigns impacting more than 100 organizations, primarily in the United States and the United Kingdom.
Industries
Financial institutionsThe campaign uses phishing emails, malicious archives, and staged payloads to target organizations supporting Ukraine, as well as NGOs, think tanks, governments, and financial institutions.Think tanksThe campaign uses phishing emails, malicious archives, and staged payloads to target organizations supporting Ukraine, as well as NGOs, think tanks, governments, and financial institutions.