MalwarePublished 30 Sep 2026

Russian APT Star Blizzard Uses ‘RedFlick’ Infection Chain in Recent Attacks

Source SecurityWeek

phishing

Description

Russian state-sponsored APT Star Blizzard has employed a new malware delivery technique called RedFlick in large-scale phishing campaigns targeting Ukrainian individuals and institutions, as well as international NGOs, think tanks, governments, and financial institutions supporting Ukraine. The infection chain involves sending a password-protected archive containing a shortcut file disguised as a PDF, which executes a background script to deliver the CosmicPulse Python backdoor. The group uses scheduled tasks for persistence and has adapted its tactics to evade detection, including multistage execution chains involving PowerShell and MSI installers.

Impact

The threat actor can gain persistent remote access to targeted systems via the CosmicPulse backdoor, enabling espionage and data exfiltration against high-value targets such as governmental organizations, NGOs, think tanks, and financial institutions. The use of sophisticated delivery and persistence techniques increases the likelihood of successful infection and evasion of detection, posing significant risks to confidentiality and operational security of affected organizations.

Defensive guidance

Mitigation should focus on user awareness to prevent phishing email interactions, especially responding to suspicious messages and opening password-protected archives. Organizations should monitor for indicators of compromise related to scheduled tasks named 'Internet Quality Test Connection,' 'Network Configuration Manager,' and 'System Health Monitor.' Employing endpoint detection solutions capable of identifying malicious shortcut files, PowerShell execution, and unusual MSI installations can help detect and block this infection chain.

Summary

Star Blizzard, linked to the Russian FSB Centre 18, has shifted from ClickFix-based delivery to using VHDX files with embedded RedFlick payloads in phishing campaigns observed in 2026. The RedFlick infection chain requires a single user interaction: responding to a phishing email triggers a second email with a password-protected archive containing a malicious shortcut file. This shortcut executes a background script that fetches an MSI installer, sets scheduled tasks for persistence, and launches downloaders (NoroBot or BaitSwitch) to deploy the CosmicPulse backdoor. The group has used scheduled tasks masquerading as legitimate system processes for persistence and has adapted delivery methods to evade defenses. Campaigns have targeted entities supporting Ukraine and have involved mass-mailing phishing platforms and compromised websites.

References

securityweek.com/russian-apt-star-blizzard-uses-redflick-infection-chain-in-recent-attacks/ (opens in a new tab)

Community reviews

Loading reviews…

Description

AI analysisMachine-generated, updated 30 Sep 2026, 11:12 UTC

References

Community reviews

Related threats