Star Blizzard RedFlick Phishing Uses Windows Tools to Deploy CosmicPulse Backdoor

This matters to Windows administrators. RedFlick is not an exploit and there is nothing to patch. It is social engineering plus the misuse of standard Windows tools, so detection and configuration are the defenses.

Who Star Blizzard is and who it targets​

Microsoft notes that CISA attributes Star Blizzard as subordinate to Centre 18 of Russia's Federal Security Service (FSB). CISA has tracked the group's spear-phishing publicly since at least its December 2023 advisory. CyberScoop points out that Star Blizzard has been known by other names as well: SEABORGIUM, Callisto Group, TA446 and COLDRIVER. If your threat feeds use a different vendor's naming, you may know it by one of those.

Microsoft says the RedFlick campaigns targeted:

• Ukrainian individuals and institutions
• International NGOs and Western think tanks
• Governments and diplomatic or multilateral bodies
• Financial institutions that have backed Ukraine politically or financially

Microsoft has seen the activity affect more than 100 organizations, mostly in the United States and United Kingdom. It says this fits the group's long-standing targeting priorities, and it notifies targeted or compromised customers directly.

Summary: The actor and its goal, espionage against people and organizations connected to Ukraine, are the same as before. The methods and the volume are what changed.

From handcrafted spear phishing to mass mailing​

Star Blizzard's usual method was patient impersonation. It would pretend to be a known political or diplomatic figure, start a conversation, and only later send a malicious link. In 2026, Microsoft says, campaigns ran from tens to hundreds of messages each, a scale it had not seen from this actor before. Microsoft believes the group probably adopted a mass-mailing phishing platform. That is an assessment, not a confirmed finding.

Microsoft counted at least 13 distinct large-scale campaigns from January onward. The lures followed a clear progression:

The Atlantic Council lure in March did not deliver RedFlick. Respondents instead got a link to install the DarkSword iOS backdoor. Microsoft also cites Proofpoint's March report that the group had targeted vulnerable Apple iOS devices with DarkSword.

Microsoft suggests the early focus on Ukraine may have been a test run before the group expanded worldwide in March. It presents this as a possibility, not a conclusion. Other details stand out:

• Internal-looking mail. Messages often reached several people at one organization and were written to look like internal communications.
• Steganography. A mid-August campaign hid identifiers this way, a technique not previously linked to Star Blizzard.
• Per-target archives. In the August payment-advice campaign, each target received a unique ZIP file, which makes hash-based blocking less useful.

Summary: The lures look like routine professional mail: event invitations, payment notices, government letters. The people most likely to receive them are the ones who get this kind of mail every day.

The reply-first trap​

The delivery pattern is consistent across campaigns. The first email usually has no attachment. The Hacker News summarizes it: The first email usually carries no attachment. If the target replies, the group sends a password-protected RAR or ZIP archive, with the password shown in an image.

Each step has a purpose:

• A first message with no attachment passes most content scanners.
• A password-protected archive keeps gateway tools from inspecting the files inside.
• Putting the password in an image keeps it away from text-based filters.

Sending from compromised websites​

Since March, Star Blizzard has sent phishing mail from accounts it created on compromised websites hosted on cPanel and WordPress. It reuses the same account name across several domains. Microsoft assesses with high confidence that the group compromised these sites for this purpose.

Before, the group mostly used free mail services, mainly Proton Mail and Microsoft consumer accounts, to pose as people the target would know. Those older methods have not stopped. Microsoft says Proton addresses still appear in the group's Evilginx credential-phishing operations in 2026.

Microsoft offers one simple check. The sender often shows a real person's name and a real organization's name, but the organization appears in the username (the part before the @), not in the registered domain. An address that starts with a respected think tank's name and ends with an unrelated small-business domain should be treated as suspicious.

Inside RedFlick: three delivery variants​

Microsoft describes RedFlick as needing only a single user interaction. The group's earlier ClickFix chains made victims carry out several steps before CosmicPulse was installed. The Hacker News describes that older method as fake CAPTCHA pages that tricked targets into running commands themselves. Microsoft documents three main changes to the delivery chain between January and August.

January: the VHDX variant​

1. A password-protected ZIP contains a VHDX virtual disk file.
2. Inside the disk are an LNK shortcut disguised as a PDF, a hidden folder with a BAT script, and a real decoy PDF.
3. Opening the LNK starts conhost.exe in a hidden window, which starts cmd.exe to run the BAT script.
4. The script opens the decoy PDF and runs ssh.exe with PermitLocalCommand enabled, which downloads and runs a remote MSI installer.
5. The MSI creates a scheduled task. The task uses control.exe to download and run the CosmicPulse downloader, which is built as a Control Panel applet (CPL) DLL.

April: three decoy scheduled tasks​

In January the MSI created one scheduled task. By April it created three, each named to look like an ordinary network component:

• "Internet Quality Test Connection" sends the host or network name and the username to the command-and-control (C2) server as a UTF-16, Base64-encoded string. It can also run a remote attacker DLL through Control_RunDLL in Shell32.dll, using a WebDAV UNC path so the file travels over HTTP instead of SMB. Microsoft says it could not obtain a sample of that DLL.
• "Network Configuration Manager" prepares Windows' WebDAV redirector and WebClient functionality so the other tasks can reach web resources as if they were file paths.
• "System Health Monitor" uses control.exe to reach a remote path on the hardcoded C2 server and run the next stage.

In at least one incident, Microsoft saw either the first or the third task deploy CosmicPulse. Microsoft also notes overlap with spear-phishing that Digital Security Lab Ukraine reported in June.

July: commands hidden in a PDF​

1. A password-protected RAR archive, nested inside a ZIP, contains an LNK file.
2. The LNK uses conhost.exe and curl to download a PDF from an attacker-controlled server.
3. A PowerShell payload searches the PDF for the marker cAB, pulls out the next 208 bytes of Base64 data, and runs the decoded command.
4. That command tries to download and install another MSI. Obfuscated PowerShell in the installer then tries to create two scheduled tasks: a helper task and one that downloads another CPL applet.

What CosmicPulse does after that​

The CPL downloader is also publicly known as NOROBOT or BAITSWITCH. Its steps:

• It downloads two ZIP files.
• It writes an encrypted AES key to HKEY_CURRENT_USER\Software\Classes\.mollis.
• One ZIP holds a 64-bit Python 3.8 package and a bootstrapper script.
• The bootstrapper decrypts the stored key with an embedded AES-ECB key, then uses it to decode the backdoor (also known as YESROBOT) from the second ZIP.

Microsoft says the backdoor has been changed in small ways throughout 2026 to evade existing signatures, but its capabilities and purpose are unchanged.

Summary: Only the first click, on the LNK, needs the user. After that the chain runs on trusted Windows programs.

What defenders should do now​

Microsoft's recommendations are aimed mainly at government bodies, NGOs and think tanks working on Ukraine policy or support. Most of them are sound hygiene for any Windows environment.

Identity and email

• Use phishing-resistant authentication and Conditional Access. Microsoft recommends security defaults as a starting point and continuous access evaluation on top.
• Turn on Safe Links and Safe Attachments in Microsoft Defender for Office 365, and set links to be rechecked when clicked.
• Use Attack Simulator for user training. Microsoft notes it currently supports only link-based phishing emails.

Endpoint

• Run Defender for Endpoint EDR in block mode, set automated investigation and remediation to full, and turn on cloud-delivered protection, automatic sample submission and network protection.
• Enable the attack surface reduction rules that block rare, new or untrusted executables and obfuscated scripts.
• Encourage browsers that support Defender SmartScreen.
• Block or restrict outbound SSH the business does not need. The January variant used SSH to fetch its installer.

Hunting

• Search for the three task names listed above and for the Defender detections Trojan:Script/RedFlick, Backdoor:Script/CosmicPulse and Backdoor:Python/CosmicPulse.
• Microsoft's Defender XDR queries look for conhost.exe launching curl, SSH starting a local command prompt, and the masquerading task names. Microsoft warns they can return legitimate activity, so check each result.
• The Hacker News notes that Microsoft's 3 Defender XDR hunting queries... look back only 7 days as published. Defender's advanced hunting keeps up to 30 days of raw data, so checking back to January needs logs kept longer, for example in Microsoft Sentinel.
• Sentinel customers can use the TI Map analytics and ASIM-based queries against Microsoft's indicator list, which covers archive hashes and delivery infrastructure such as etia[.]ca, groy[.]cc and secure-dns-hub[.]com. Use the full list in Microsoft's published report, and treat a match as a lead to investigate rather than proof of compromise.
• For iPhone users, The Hacker News recommends updating to iOS 26.3 or later because of the DarkSword iOS component.

For end users: If an event invitation arrives, you reply, and a password-protected archive follows, confirm with the supposed sender through a phone number or address you already have before opening anything.

The bigger picture​

A few points are worth weighing:

• Most detail comes from Microsoft. Microsoft is a primary source here and also sells the products it recommends. The core defenses (MFA that resists phishing, restricting SSH, attack surface reduction rules, callback verification) are vendor-neutral, and the task names and command patterns can be hunted with any EDR.
• Scale costs stealth. Mass mailing reaches more people but leaves more traces, such as reused account names and bulk sending patterns. Defenders can use that.
• Built-in tools are the real problem. RedFlick relies on SSH, WebDAV, control.exe and scheduled tasks, all of which ship with Windows. It is worth asking which of them your users actually need.

Star Blizzard has a record of changing tactics after public exposure. After this report, expect another change.