Star Blizzard Expands Phishing Campaigns With RedFlick and CosmicPulse
Summary
Microsoft reported at least 13 Star Blizzard campaigns affecting more than 100 organizations in 2026. The activity used conversation-based phishing and password-protected archives to deliver RedFlick and, in at least one incident, the CosmicPulse backdoor.
Key points
- Microsoft reported that campaigns observed from January to August 2026 targeted more than 100 organizations across at least 13 campaigns, primarily in the United States and United Kingdom.
- Star Blizzard shifted toward broader initial-contact operations, using replies to establish conversations before sending password-protected RAR or ZIP archives.
- Archives contained VHDX or LNK files disguised as PDFs, which launched scripts and legitimate Windows utilities to retrieve additional components.
- From April, RedFlick installers created scheduled tasks, collected basic host information, enabled WebDAV access, and retrieved components used to install CosmicPulse.
- In July, a ZIP containing a password-protected RAR added another delivery layer; a shortcut retrieved a PDF with encoded data that PowerShell used to obtain an MSI installer.
- Microsoft observed RedFlick communicating with remote infrastructure, creating scheduled tasks, and deploying CosmicPulse in at least one incident.
- The article recommends reviewing email threads and encrypted archives, monitoring extraction and execution activity, and isolating potentially affected systems for investigation.
Article Details
- Attack Vectors
- Star Blizzard used phishing emails to establish conversations with recipients, then sent password-protected RAR or ZIP archives with the password embedded as an image.
- Archives contained VHDX files or LNK files disguised as PDFs that initiated the RedFlick delivery chain.
- In a July 2026 variant, a password-protected RAR archive was nested inside a ZIP file; a shortcut downloaded a PDF containing encoded data that PowerShell extracted and executed to retrieve an MSI installer.
- RedFlick installers retrieved components from threat actor-controlled infrastructure, created scheduled tasks, enabled WebDAV access, and deployed the CosmicPulse backdoor.
- Defensive Notes
- Review email telemetry for password-protected archives sent after earlier attachment-free messages, especially where the sender provides a password during the conversation.
- Monitor archive extraction followed by VHDX mounting, LNK execution, MSI installation, PowerShell activity, WebDAV use, scheduled-task creation, or connections to unfamiliar external infrastructure.
- Use additional review processes for encrypted archives that cannot be inspected, where business requirements permit.
- If execution may have occurred, isolate the affected system; preserve the email thread and archive; review scheduled tasks and persistence mechanisms; collect process and network telemetry; and investigate affected accounts, sessions, mailbox rules, and recent communications.
MITRE ATT&CK
T1027 · Obfuscated Files or InformationA PDF containing encoded data was processed by PowerShell to retrieve an MSI installer.T1053.005 · Scheduled TaskRedFlick installers created scheduled tasks.T1059.001 · PowerShellPowerShell extracted and executed encoded data to retrieve an MSI installer.T1105 · Ingress Tool TransferScripts and legitimate Windows utilities retrieved additional components from threat actor-controlled infrastructure.T1218 · System Binary Proxy ExecutionThe delivery chain used legitimate Windows utilities to retrieve additional components.T1219 · Remote Access ToolsThe report says RedFlick enabled WebDAV access.T1566.002 · Spearphishing LinkStar Blizzard sent phishing emails with password-protected archives as attachments after establishing email conversations with recipients.T1566.003 · Spearphishing via ServiceThe archive password was provided as an image within the phishing email.
Threat Actors
Malware
CosmicPulsecompromised web infrastructure, and a new RedFlick delivery chain that ultimately deployed the CosmicPulse backdoor.RedFlickthroughout 2026, combining larger initial-contact campaigns, compromised web infrastructure, and a new RedFlick delivery chain that ultimately deployed the CosmicPulse backdoor.
Vendors
Products
Countries
Ukrainein government, diplomacy, research, public policy, journalism, and financial activities connected to Ukraine, with more than 100 organizations affected across at least 13 campaigns.United KingdomBetween January and August 2026, Microsoft observed at least 13 campaigns affecting more than 100 organizations, primarily in the United States and United Kingdom.United StatesBetween January and August 2026, Microsoft observed at least 13 campaigns affecting more than 100 organizations, primarily in the United States and United Kingdom.
Industries
DiplomacyThe activity targeted organizations involved in government, diplomacy, research, public policy, journalism, and financial activities connected to Ukraine, with more than 100 organizations affected across at least 13financial activitiestargeted organizations involved in government, diplomacy, research, public policy, journalism, and financial activities connected to Ukraine, with more than 100 organizations affected across at least 13 campaigns.GovernmentThe activity targeted organizations involved in government, diplomacy, research, public policy, journalism, and financial activities connected to Ukraine, with more than 100 organizations affected across at least 13JournalismThe activity targeted organizations involved in government, diplomacy, research, public policy, journalism, and financial activities connected to Ukraine, with more than 100 organizations affected across at least 13public policyThe activity targeted organizations involved in government, diplomacy, research, public policy, journalism, and financial activities connected to Ukraine, with more than 100 organizations affected across at least 13ResearchThe activity targeted organizations involved in government, diplomacy, research, public policy, journalism, and financial activities connected to Ukraine, with more than 100 organizations affected across at least 13