Star Blizzard Expands Phishing Campaigns and Adopts RedFlick Malware Delivery
Summary
Microsoft says Russia-linked Star Blizzard has expanded its phishing campaigns since January and adopted RedFlick, a delivery technique that uses scheduled tasks to deploy its CosmicPulse backdoor with less victim interaction.
Key points
- Microsoft observed 13 large-scale phishing campaigns since January, targeting NGOs, think tanks, and government organizations.
- Campaigns expanded beyond Ukrainian targets and sent hundreds of messages, including emails impersonating organizations’ internal communications.
- RedFlick uses password-protected ZIP or RAR archives with disguised LNK files and Windows utilities to start an MSI-based infection chain.
- Scheduled tasks help execute malware and deploy the CosmicPulse backdoor while requiring less user interaction than the actor’s earlier ClickFix approach.
- A separate infection chain observed in July concealed PowerShell payload data in an apparently legitimate PDF.
- Microsoft recommends phishing-resistant authentication, conditional access, email and web protections, EDR block mode, and browsers with Defender SmartScreen.
Article Details
- Event Type
- Russia-linked phishing and malware-delivery campaign involving a shift from ClickFix to the RedFlick delivery technique.
- Impact
- Star Blizzard's campaigns have expanded in scale and geographic reach, targeting organizations worldwide and reducing the victim interaction needed to deliver malware. The campaigns deploy the CosmicPulse backdoor; Microsoft warned the change may increase the actor's chance of success.
People
Threat Actors
CallistoName the article explicitly gives as an alternative name for Star Blizzard.COLDRIVERName the article explicitly gives as an alternative name for Star Blizzard.Star BlizzardRussia-linked APT actor conducting phishing campaigns and deploying malware; the article says it is also referred to as ColdRiver and Callisto.
Malware
CosmicPulsehelps evade detection by initiating a set of scheduled tasks to deploy the actor's custom backdoor, CosmicPulse," according to MTI's post.DarkSwordsteganography to conceal identifiers and the targeting of vulnerable Apple iOS devices to deploy the DarkSword backdoor, as reported by Proofpoint in March.
Vendors
Applewith the actor, including steganography to conceal identifiers and the targeting of vulnerable Apple iOS devices to deploy the DarkSword backdoor, as reported by Proofpoint in March.MicrosoftA Russia-linked advanced persistent threat (APT) actor that was significantly disrupted by Microsoft and US officials two years ago is casting a wider net than ever with its phishing and malware-delivery tactics. In
Products
iOSwith the actor, including steganography to conceal identifiers and the targeting of vulnerable Apple iOS devices to deploy the DarkSword backdoor, as reported by Proofpoint in March.Microsoft Defender SmartScreenMicrosoft also encouraged organizations to use Web browsers that support Microsoft Defender SmartScreen, which identifies and blocks malicious websites, including phishing sites, scam sites, and sites that host malware.Microsoft Windowsinfection paths that all share a common thread: an effort to make malicious execution blend into normal Windows activity while reducing the amount of work required from the victim.
Countries
RussiaA Russia-linked advanced persistent threat (APT) actor that was significantly disrupted by Microsoft and US officials two years ago is casting a wider net than ever with its phishing and malware-delivery tactics. InUkrainejournalists, nongovernmental organizations (NGOs), and Russia experts — particularly those supporting Ukraine — has since January demonstrated a key tactical change in its phishing initial-access method, Microsoft
Industries
Governmentdetecting 13 distinct "large-scale phishing campaigns targeting primarily NGOs, think tanks, and government organizations worldwide" since January. Though early campaigns targeted users of the Ukrainian emailNon-governmental organizationsThink tanksevolve, with Microsoft detecting 13 distinct "large-scale phishing campaigns targeting primarily NGOs, think tanks, and government organizations worldwide" since January. Though early campaigns targeted users of the