Star Blizzard, a Russian state-backed threat actor, has adopted a fresh installation method called RedFlick to distribute its CosmicPulse backdoor malware. While the underlying technique itself is not novel in cybersecurity, its application represents a departure for this group, enabling more automated assault chains and requiring less active participation from targets.
According to findings from Microsoft researchers, Star Blizzard broadened its phishing reach and refined its malware distribution mechanisms during 2026. The group, which has operated since 2017, maintains a track record of experimenting with alternative payload delivery channels such as ClickFix and WhatsApp, alongside regularly introducing and deploying fresh malware variants.
How RedFlick works
The RedFlick attack sequence initiates with a phishing message—typically framed as an invitation—followed by a second communication containing a password-secured ZIP or RAR file. Inside the archive sits a VHDX virtual disk housing an LNK shortcut masquerading as a PDF document. Opening the file triggers a concealed command execution while presenting a fake PDF to distract the user.
The hidden commands retrieve and execute an MSI installer that establishes three scheduled tasks mimicking legitimate system maintenance functions, each serving a distinct role:
- Internet Quality Test Connection: transmits the machine and network identifiers plus username to attackers and permits execution of a remote DLL
- Network Configuration Manager: enables Windows WebDAV capabilities to allow remote web resources to be accessed via file-style paths
- System Health Monitor: leverages control.exe to run a remotely hosted next-stage payload
By splitting the infection process across multiple scheduled tasks with separate functions, the attacker gains an advantage in bypassing detection mechanisms at various points in the compromise chain.
The subsequent payload is a downloader identified as NOROBOT and BAITSWITCH, delivered as a Control Panel applet file with a .cpl extension. Its function is to obtain and launch the CosmicPulse backdoor.
BAITSWITCH retrieves two ZIP packages: one containing Python 3.8 for the 64-bit architecture and a Python script that bootstraps CosmicPulse. According to Microsoft, "The bootstrapper reads the encrypted key from the registry, recovers it using an embedded key in AES-ECB mode, and then uses the recovered key to decode the CosmicPulse payload."
Microsoft notes that the backdoor's observed functionality aligns with capabilities documented in a Google report from October 2025, encompassing execution of attacker-controlled Python scripts to download and run files or exfiltrate documents from compromised machines.
From an operational standpoint, RedFlick demands only that a victim activate the malicious shortcut to set off the entire automated infection sequence. This contrasts with earlier ClickFix campaigns where Star Blizzard compelled targets to perform numerous manual steps.
Campaign scope and targets
Microsoft has documented at least 13 large-scale phishing operations since the start of the year, affecting over 100 organizations predominantly across the United States and United Kingdom. The researchers state that "The RedFlick campaigns have targeted Ukrainian individuals and institutions, as well as international NGOs, think tanks, governments, and financial institutions that have supported Ukraine politically or financially."
Defensive measures
Despite evolving its tactics, techniques and procedures, Star Blizzard persists in impersonating legitimate contacts and organizations while leveraging complimentary email services to distribute phishing content. Microsoft recommends organizations implement phishing-resistant authentication mechanisms, deploy Conditional Access policies, strengthen email filtering, and independently confirm suspicious communications using known contact information.
The company further advises deploying endpoint detection and response solutions configured in block mode to prevent successful infections by quarantining malicious components before antivirus detection occurs.