Star Blizzard Deploys New RedFlick Technique for Stealthy Malware Delivery
The Russian state-sponsored threat actor Star Blizzard has been observed using a novel malware delivery method called "RedFlick" to deploy its CosmicPulse backdoor, according to Microsoft researchers. While the underlying components are not entirely new, the technique represents a significant evolution in the group's tactics, enabling greater automation and reduced victim interaction during infection.
Star Blizzard, active since 2017, has a history of experimenting with innovative payload delivery methods, including ClickFix and WhatsApp-based lures. In 2026, the group expanded its phishing operations and refined its infection chain to streamline compromise of target systems.
How the RedFlick Attack Chain Works
RedFlick attacks typically begin with a phishing email, often disguised as an invitation or legitimate correspondence. This is followed by a second message containing a password-protected ZIP or RAR archive. Inside the archive is a VHDX virtual disk file that houses a malicious LNK file designed to appear as a PDF document.
When the victim opens the LNK file, it executes a command in a hidden window while displaying a decoy PDF to avoid suspicion. This hidden command triggers the download and execution of an MSI installer, which creates three scheduled tasks on the compromised system, each masquerading as legitimate maintenance software:
- Internet Quality Test Connection: Collects and exfiltrates the computer name, network name, and username to the attackers; capable of executing remote DLLs.
- Network Configuration Manager: Configures Windows WebDAV functionality to allow access to remote web resources via file-style paths.
- System Health Monitor: Uses control.exe to retrieve and execute a next-stage payload from a remote server.
By separating malicious functionality across multiple scheduled tasks, Star Blizzard increases the difficulty of detection, as each task performs a distinct and seemingly benign action.
Next-Stage Payload and CosmicPulse Deployment
The System Health Monitor task fetches a downloader known as NOROBOT or BAITSWITCH, delivered as a Control Panel applet (.cpl). BAITSWITCH then downloads two ZIP archives: one containing the Python 3.8 64-bit runtime and another with a Python-based bootstrapper for the CosmicPulse backdoor.
According to Microsoft, the bootstrapper retrieves an encrypted key from the Windows registry, decrypts it using an embedded AES-ECB key, and uses the recovered key to decode and execute the CosmicPulse payload. This modular approach allows the attackers to update or replace components without redesigning the entire infection chain.
The CosmicPulse backdoor, whose capabilities have remained consistent since its analysis by Google in October 2025, enables attackers to run arbitrary Python code, download and execute additional files, and exfiltrate documents from infected systems.
RedFlick Reduces Victim Interaction Compared to Prior Tactics
Unlike the ClickFix technique, which required victims to perform multiple manual steps to enable infection, RedFlick only necessitates that the user open the malicious LNK file. From that point, the entire infection chain proceeds automatically, significantly increasing the efficiency of the attack.
Microsoft reports that since the beginning of 2026, it has observed at least 13 large-scale phishing campaigns using RedFlick or similar tactics, affecting over 100 organizations primarily in the United States and the United Kingdom. The campaigns have specifically targeted Ukrainian individuals and institutions, as well as international NGOs, think tanks, government agencies, and financial entities that have provided political or financial support to Ukraine.
Despite evolving its methods, Star Blizzard continues to rely on social engineering, impersonating trusted contacts or organizations, and leveraging free email services to distribute phishing messages.
Mitigation and Defense Recommendations
Microsoft advises organizations to implement phishing-resistant multi-factor authentication, enforce Conditional Access policies, deploy advanced email protection solutions, and verify suspicious communications through known, trusted channels. Additionally, the use of endpoint detection and response (EDR) tools in block mode is recommended to prevent execution of malicious artifacts, even if they evade traditional antivirus detection.
Source: BleepingComputer