Cybersecurity
Star Blizzard used RedFlick to deliver CosmicPulse
Microsoft said Star Blizzard used a new delivery approach called RedFlick in 2026 to automate phishing chains that installed the CosmicPulse backdoor and targeted organisations supporting Ukraine.
- Microsoft researchers said Star Blizzard used RedFlick as a newer way to deliver malware and reduce victim interaction.
- The attacks began with phishing emails and follow-up messages carrying password-protected archives with VHDX disks and disguised LNK files.
- Opening the file triggered hidden commands, an MSI installer and scheduled tasks that prepared WebDAV access and launched a remote payload.
- Microsoft said the next stage was NOROBOT, also called BAITSWITCH, which fetched the CosmicPulse backdoor.
- Microsoft said it had seen at least 13 phishing campaigns since the start of the year, affecting more than 100 organisations mainly in the United States and the United Kingdom, and that the targets included Ukrainian individuals and institutions plus NGOs, think tanks, governments and financial institutions supporting Ukraine.
Microsoft said Star Blizzard had used RedFlick as a delivery path for CosmicPulse. The first message was a phishing email, followed by a second one carrying a password-protected archive.
The archive held a VHDX disk and a shortcut file made to look like a PDF. When opened, it ran hidden commands and showed a decoy document.
Those commands downloaded an MSI installer that created three scheduled tasks. Microsoft said one task sent machine and user details, another prepared WebDAV access, and a third launched a remote payload.
Microsoft said the next stage was NOROBOT, also named BAITSWITCH, delivered as a .cpl file. BAITSWITCH then pulled down two ZIP files, including Python 3.8 and a bootstrapper that decoded CosmicPulse.
Microsoft said it had observed at least 13 phishing campaigns since the start of the year, affecting more than 100 organisations in the United States and the United Kingdom. It said the campaigns targeted Ukrainian individuals and institutions, along with NGOs, think tanks, governments and financial institutions that supported Ukraine, and it advised stronger authentication, conditional access, email filtering and EDR block mode.
Named in this story
Companies
- Microsoft
- the company whose researchers analysed the campaigns and issued advice
- the company whose October 2025 report Microsoft cited
Organisations
- Star Blizzard
- the Russian state actor that used RedFlick
Products and systems
- RedFlick
- the delivery approach used in the phishing chain
- CosmicPulse
- the backdoor the chain was built to install
- NOROBOT
- the downloader that fetched CosmicPulse
- BAITSWITCH
- the downloader alias Microsoft used for the same stage
Places
- Ukraine
- the country linked to many of the targeted people and institutions
- United States
- one of the main countries where affected organisations were found
- United Kingdom
- one of the main countries where affected organisations were found
How the source tells it
The piece was mostly a technical report, with a short advisory close, and it did not lean on emotive framing.
No emotive framing was found in the original.