Star Blizzard, linked to the Russian FSB Centre 18, has shifted from ClickFix-based delivery to using VHDX files with embedded RedFlick payloads in phishing campaigns observed in 2026. The RedFlick infection chain requires a single user interaction: responding to a phishing email triggers a second email with a password-protected archive containing a malicious shortcut file. This shortcut executes a background script that fetches an MSI installer, sets scheduled tasks for persistence, and launches downloaders (NoroBot or BaitSwitch) to deploy the CosmicPulse backdoor. The group has used scheduled tasks masquerading as legitimate system processes for persistence and has adapted delivery methods to evade defenses. Campaigns have targeted entities supporting Ukraine and have involved mass-mailing phishing platforms and compromised websites.

The threat actor can gain persistent remote access to targeted systems via the CosmicPulse backdoor, enabling espionage and data exfiltration against high-value targets such as governmental organizations, NGOs, think tanks, and financial institutions. The use of sophisticated delivery and persistence techniques increases the likelihood of successful infection and evasion of detection, posing significant risks to confidentiality and operational security of affected organizations.

No vendor advisory or patch information is provided for this threat. Mitigation should focus on user awareness to prevent phishing email interactions, especially responding to suspicious messages and opening password-protected archives. Organizations should monitor for indicators of compromise related to scheduled tasks named 'Internet Quality Test Connection,' 'Network Configuration Manager,' and 'System Health Monitor.' Employing endpoint detection solutions capable of identifying malicious shortcut files, PowerShell execution, and unusual MSI installations can help detect and block this infection chain.