RedFlick Reduces Victim Interaction in Star Blizzard’s Espionage Phishing Campaigns

Russian-linked operators overhaul malware delivery

Star Blizzard has adopted RedFlick in its phishing operations, a delivery technique designed to install the CosmicPulse backdoor with substantially less victim interaction.

Microsoft described the change in an analysis published on September 29, 2026. The company identifies Star Blizzard as a Russian state threat actor conducting cyberespionage against organizations connected to international policy and support for Ukraine.

Targets include Ukrainian individuals and institutions, international NGOs, Western think tanks, governments, and other policy-focused organizations. SecurityWeek also lists financial institutions supporting Ukraine among the targeted sectors.

Star Blizzard’s recent activity combines higher-volume email campaigns with a delivery chain that requires only one user action to execute malware. Microsoft assesses that this combination can extend the actor’s reach, reduce opportunities for detection, and increase the probability of compromise.

SecurityWeek reports that Microsoft observed more than a dozen campaigns containing RedFlick attachments between January and August 2026. SecurityWeek also reports phishing email volumes in the tens to hundreds per campaign, likely using a mass-mailing phishing platform.

SecurityWeek reports that Star Blizzard is believed to be subordinate to Centre 18 of Russia’s Federal Security Service (FSB).

Phishing messages move from conversation to malware

The attacks begin with messages crafted to resemble communications from Ukrainian authorities, established think tanks, or NGOs. Some are made to appear as though they originated inside the recipient’s own organization.

According to SecurityWeek’s account of the campaigns, the operator waits for a recipient to answer the initial email. It then sends a follow-up containing a password-protected RAR or ZIP archive.

Once that archive has reached the target, malware execution requires a single user interaction. This is a significant departure from Star Blizzard’s earlier ClickFix chains, which required users to perform several manual steps.

SecurityWeek also associates Star Blizzard with the DarkSword iOS exploit kit and says the group has used downloaders called NoroBot or BaitSwitch. In the RedFlick campaigns, those downloaders act as intermediaries for CosmicPulse, a custom Python backdoor attributed to the actor.

VHDX containers, fake PDFs, and scheduled tasks

The RedFlick chain changed repeatedly during the observed campaign period.

In January 2026, Star Blizzard began sending malicious Virtual Hard Disk containers using the VHDX format. A shortcut inside the container was disguised as a PDF document. Clicking it displayed a decoy file while launching a script in the background.

That script retrieved an MSI installer, created scheduled tasks for persistence, and started NoroBot or BaitSwitch. The downloader then delivered CosmicPulse.

This arrangement concealed several stages behind what appeared to be a document-opening action.

The persistence mechanism evolved further in April 2026. Three observed RedFlick scheduled tasks masqueraded under these names:

• Internet Quality Test Connection
• Network Configuration Manager
• System Health Monitor

In July 2026, Star Blizzard deployed another multistage sequence. A malicious LNK shortcut started a PowerShell payload, which attempted to download an MSI file. That installer then tried to create two more scheduled tasks.

By August 2026, the operator was sending a different ZIP file to each target. Per-recipient archives can complicate hash-based detection because defenders cannot assume every recipient received an identical attachment.

Microsoft characterizes the move from ClickFix to VHDX files, PDF-disguised shortcuts, PowerShell, MSI packages, and scheduled-task persistence as a broader revision of Star Blizzard’s delivery and evasion tradecraft.

Files and infrastructure defenders should search for

Microsoft published five SHA-256 hashes associated with RedFlick campaigns:

The last three files were used in June, July, and August 2026, respectively. The August archive was connected to the tactic of generating unique ZIP files for individual targets.

Infrastructure associated with RedFlick installers, PowerShell code, CosmicPulse downloaders, or the backdoor includes:

etia[.]ca
groy[.]cc
gliderrompercycl[.]com
muvb[.]net
divekickspolic[.]org
matjk[.]click
bpdaersa[.]click
stuseamandesilt[.]org
Itechx[.]tel
guach[.]net
ruten[.]observer
byveo[.]org
secure-dns-hub[.]com
qumel[.]link
cyrna[.]top
drasw[.]club

103.245.231[.]248
2.57.241[.]246
89.125.209[.]168
103.245.231[.]79
45.84.59[.]66
103.160.59[.]97

Defenders should correlate these indicators with DNS, proxy, firewall, endpoint, and email telemetry rather than treating a single match as sufficient context. Historical searches are particularly relevant because the infrastructure spans multiple campaign stages and months.

Hunting for execution and persistence

Microsoft identifies two Defender XDR hunting leads: Conhost.exe invokes curl and Invoke SSH to launch local command line. Security teams can use these process relationships as starting points for endpoint investigations.

Microsoft also provides ASIM-based network-session and web-session searches covering a 30-day lookback. Both check the six IPv4 addresses and 16 domains listed above.

The network-session query summarizes first-seen time, last-seen time, and event count across fields including source address, destination address, destination domain, device, product, and vendor. The web-session version additionally examines URLs.

Beyond the published indicators, security teams can look for behavioral combinations associated with the chain:

• LNK files launched from VHDX containers.
• Shortcuts masquerading as PDF documents.
• PowerShell retrieving MSI packages.
• MSI execution followed by scheduled-task creation.
• Tasks using the three reported names.
• Network connections from scripting or installer processes to the listed infrastructure.
• Password-protected archives arriving after an earlier email exchange.

Identity teams should also investigate anomalous sign-ins, including unusual locations, internet service providers, user agents, or anonymizer services.

Controls that can interrupt RedFlick

Microsoft recommends running endpoint detection and response in block mode, including where Defender Antivirus is passive or another antivirus product is installed, to remediate malicious artifacts detected after compromise. Separately, full automated investigation and remediation can take immediate action on alerts to resolve breaches.

Organizations should enable real-time antivirus protection, cloud-delivered protection, and automatic sample submission. Microsoft also recommends the attack-surface-reduction rule that blocks potentially obfuscated scripts.

Email and web controls provide another interception point. Zero-hour auto purge can retroactively quarantine malicious messages after new intelligence becomes available, while Safe Links rechecks destinations when users click them. Network protection and browsers supporting Microsoft Defender SmartScreen can block known malicious or phishing infrastructure.

For identity protection, Microsoft advises using security defaults or more granular Conditional Access policies. Requiring compliant devices or trusted IP addresses can limit access obtained with stolen credentials. Microsoft also recommends continuous access evaluation.

These controls do not depend solely on recognizing one attachment hash. That is crucial against an operator now generating unique ZIP files and using scheduled tasks for persistence. RedFlick reduces friction for the victim; defenders need controls that add friction at every subsequent stage.