Star Blizzard’s RedFlick Malware-Delivery Chain: How CosmicPulse Is Deployed

Star Blizzard Uses RedFlick to Deliver CosmicPulse Backdoor

SEO description: Microsoft reports that Star Blizzard’s RedFlick campaign uses phishing, a VHDX disk, a disguised LNK shortcut, an MSI installer, and scheduled tasks to deliver the CosmicPulse backdoor.

Star Blizzard, a Russian state actor, is using RedFlick to deliver its CosmicPulse backdoor. Microsoft researchers reported at least 13 large-scale phishing campaigns since the start of 2026, affecting more than 100 organizations, chiefly in the United States and United Kingdom. Reported targets also include Ukrainian individuals and institutions, international NGOs, think tanks, governments, and financial institutions supporting Ukraine politically or financially.

The delivery chain combines familiar social engineering with Windows features. A successful phishing lure leads the recipient to open a shortcut disguised as a document, setting the installation process in motion.

How the RedFlick Infection Chain Works

The attack begins with a phishing email, such as an invitation, followed by another message containing a password-protected ZIP or RAR archive. Inside the archive is a VHDX virtual disk. It contains an LNK shortcut disguised as a PDF. Opening the shortcut runs a command in a hidden window while displaying a decoy PDF.

The command downloads and runs an MSI installer. The installer creates three scheduled tasks with names intended to resemble legitimate maintenance components, each with a distinct role:

• Internet Quality Test Connection sends the computer or network name and username to the attackers and can execute a remote DLL.
• Network Configuration Manager prepares Windows WebDAV functionality so remote web resources can be accessed through file-style paths.
• System Health Monitor uses control.exe to execute a remotely hosted next-stage payload.

Task names alone do not prove compromise. Analysts should correlate task creation with the launching process, downloaded files, network activity, and subsequent execution.

The next stage is a downloader identified as NOROBOT and BAITSWITCH, delivered as a Control Panel applet (.cpl). BAITSWITCH retrieves two ZIP archives. One contains the Python 3.8 64-bit package and a Python file that bootstraps CosmicPulse. Microsoft reports that the bootstrapper reads an encrypted key from the Windows registry, recovers it using an embedded key with AES-ECB, and uses the recovered key to decode the CosmicPulse payload.

Microsoft says CosmicPulse’s capabilities in these observed attacks remain consistent with those described in a Google report from October 2025. They include executing attacker-supplied Python code to download and run files or retrieve documents from infected systems. The reporting links RedFlick’s installation process to the backdoor, but does not claim a new payload capability in this campaign.

What Changed Compared With Earlier Activity

RedFlick reduces the number of actions required from a victim. In the earlier ClickFix activity described in the report, victims had to take several manual actions. With RedFlick, opening the malicious shortcut can trigger the automated infection chain. The phishing lure remains important, but the victim’s decisive action is simpler.

The reported campaign figures—at least 13 large-scale campaigns and more than 100 organizations affected—are observations from Microsoft’s reporting, not a measure of every attempted or successful intrusion. Star Blizzard has changed tactics, techniques, and procedures over time, but the cited reporting says it continues to impersonate trusted contacts or organizations and relies on free email providers for delivery.

The campaign’s observable sequence is more useful for defense than any single lure or file extension: an unexpected message, a protected archive, a virtual disk, a disguised shortcut, unexpected command execution, scheduled-task creation, and remote payload retrieval.

Defenses Tied to the Reported Behaviors

Microsoft recommends phishing-resistant authentication, Conditional Access policies, email protection, and independently verifying suspicious messages using established contact details. These measures address different risks: strong authentication can reduce the consequences of stolen credentials, access policies can limit account access, email protections can flag or block malicious messages, and out-of-band verification can expose impersonation before an attachment is opened.

Endpoint detection and response (EDR) configured in block mode can help prevent infections by stopping malicious artifacts even when antivirus does not identify them. Security teams can review endpoint telemetry for:

• Unexpected mounting or use of VHDX files.
• An LNK shortcut launching a hidden command.
• An MSI installation following an archive opening.
• Unexpected scheduled-task creation.
• control.exe loading a remote .cpl file.
• WebDAV-related access or Python execution from an unfamiliar package or location.

These are investigation leads grounded in the reported chain; no single event proves RedFlick activity. Teams can preserve suspicious emails and attachments, collect task and process-creation records, and examine network connections and downloaded archives. Users should report unexpected password-protected archives and invitations through a known reporting channel rather than replying to the sender or using contact information supplied in the message.

The cited reporting does not attribute AI involvement to the campaign.

Source and Scope

This account is based on BleepingComputer’s report, which summarizes Microsoft researchers’ analysis of Star Blizzard and RedFlick. Campaign figures and technical details are attributed to that reporting.

Source: BleepingComputer, Russian state hackers use new RedFlick technique to push malware