Star Blizzard Uses RedFlick Infection Chain in Recent Attacks
Summary
Microsoft says Star Blizzard has used RedFlick in attacks against Ukraine-linked targets and others. The chain delivers malware through phishing attachments, with scripts and scheduled tasks enabling payload execution and persistence.
Key points
- Microsoft reports that Star Blizzard used RedFlick in more than a dozen campaigns from January through August 2026.
- Targets included Ukrainian individuals and institutions, as well as international NGOs, think tanks, governments, and financial institutions supporting Ukraine.
- After a recipient responded to an initial phishing email, the group sent a password-protected RAR or ZIP archive; campaigns also used VHDX attachments.
- A malicious shortcut disguised as a PDF opened a decoy while running a background script that fetched an MSI installer.
- The infection chain used scheduled tasks for persistence and NoroBot or BaitSwitch downloaders to deliver the CosmicPulse Python backdoor.
- Later activity included three tasks disguised as system utilities and a multistage chain using a malicious LNK file to execute PowerShell and fetch another MSI.
Article Details
- Attack Vectors
- Star Blizzard sent spear-phishing emails with password-protected RAR or ZIP archives after recipients responded to an initial email.
- Phishing emails carried a malicious VHDX container containing a shortcut disguised as a PDF; clicking it opened a decoy while executing a background script.
- A later multistage chain used a malicious LNK file to execute a PowerShell payload.
- Defensive Notes
- Monitor for suspicious scheduled tasks, including tasks masquerading as Internet Quality Test Connection, Network Configuration Manager, or System Health Monitor.
- Inspect unexpected password-protected archives and VHDX attachments, including shortcut files disguised as PDFs and PowerShell execution from LNK files.
MITRE ATT&CK
T1036 · MasqueradingA shortcut file was disguised as a PDF, and scheduled tasks used names such as Internet Quality Test Connection, Network Configuration Manager, and System Health Monitor.T1053.005 · Scheduled TaskThe malware delivery script configured scheduled tasks for persistence, and later campaigns created additional scheduled tasks.T1059.001 · PowerShellA July execution chain used a malicious LNK file to execute a PowerShell payload.T1105 · Ingress Tool TransferA background script fetched an MSI installer, which launched a downloader to deliver the CosmicPulse Python backdoor.T1566.001 · Spearphishing AttachmentStar Blizzard used spear-phishing emails, including lures posing as Ukrainian authorities or reputable think tanks and NGOs.
Threat Actors
Malware
BAITSWITCHThat script fetches an MSI installer, configures scheduled tasks for persistence, and launches the NoroBot or BaitSwitch downloader to deliver the CosmicPulse Python backdoor.CosmicPulseThat script fetches an MSI installer, configures scheduled tasks for persistence, and launches the NoroBot or BaitSwitch downloader to deliver the CosmicPulse Python backdoor.NOROBOTThat script fetches an MSI installer, configures scheduled tasks for persistence, and launches the NoroBot or BaitSwitch downloader to deliver the CosmicPulse Python backdoor.RedFlickIn attacks observed this year, the APT has been relying on large-scale phishing attacks and a new malware delivery technique dubbed RedFlick, which requires a single user interaction for malware execution.
Vendors
Products
Countries
Industries
AcademiaService (FSB) Centre 18, Star Blizzard is known for launching targeted spear-phishing campaigns against academia, defense, governmental organizations, NGOs, and think tanks, and for using the ClickFix technique andDefenseCentre 18, Star Blizzard is known for launching targeted spear-phishing campaigns against academia, defense, governmental organizations, NGOs, and think tanks, and for using the ClickFix technique and theFinancial institutionsindividuals and institutions, as well as international NGOs, think tanks, governments, and financial institutions that have been providing support to Ukraine.Think tankstargeted spear-phishing campaigns against academia, defense, governmental organizations, NGOs, and think tanks, and for using the ClickFix technique and the DarkSword iOS exploit kit.