Star Blizzard's RedFlick technique delivers the CosmicPulse backdoor to 100+ organizations

Executive Summary

On September 29, 2026, Microsoft Threat Intelligence published technical analysis of a shift in the tradecraft of Star Blizzard, a Russian state threat actor the United States Cybersecurity and Infrastructure Security Agency (CISA) attributes as subordinate to the Russian Federal Security Service (FSB) Centre 18.¹² Since January 2026, Microsoft has observed the actor move from narrowly targeted spear-phishing to large-scale initial-contact phishing, send from accounts created on compromised websites, and adopt a new malware-delivery technique Microsoft tracks as RedFlick. RedFlick is a delivery-and-persistence technique, not a payload; it uses Windows scheduled tasks to install the actor's custom Python backdoor, CosmicPulse.¹

Microsoft counted at least 13 distinct large-scale phishing campaigns between January and August 2026, affecting over 100 organizations primarily in the United States and United Kingdom. Targeting centred on Ukrainian individuals and institutions, international NGOs, Western think tanks, governments, and financial organizations supporting Ukraine politically or financially.¹ The infection flow begins with a phishing email; once a recipient responds, the actor sends a follow-up message carrying a password-protected RAR or ZIP archive, with the password supplied as an image in the email body. In the mid-January variant, the archive held a Virtual Hard Disk v2 (VHDX) that shipped a malicious LNK file disguised as a PDF alongside a hidden BAT script and a decoy PDF; opening the LNK spawned conhost.exe and cmd.exe, ran the BAT, and used SSH.exe with PermitLocalCommand to download and run a remotely hosted MSI that created scheduled tasks to fetch CosmicPulse.¹

Star Blizzard — formerly tracked by Microsoft as SEABORGIUM and also known as Callisto Group, COLDRIVER, TA446, TAG-53, and BlueCharlie — is a long-running cyberespionage actor whose infrastructure and personnel have been the subject of prior public action: a December 2023 Five Eyes advisory and parallel US indictment and UK/US sanctions against two FSB-linked individuals, and an October 2024 joint Microsoft–Department of Justice seizure of 107 domains.²³⁴⁵ Microsoft frames RedFlick as a notable departure from the actor's 2025 ClickFix-based infection chains, which Google Threat Intelligence Group reported under the COLDCOPY name and which required victims to complete several manual steps; RedFlick, by contrast, requires a single user interaction.¹⁶

Why it matters: RedFlick is a case study in a state actor trading bespoke, high-touch targeting for scale while lowering the bar for victim interaction and leaning on trusted Windows binaries — conhost.exe, cmd.exe, ssh.exe, msiexec.exe, control.exe — to blend into normal activity. The reported scale also invites a precise reading: Microsoft said the activity affected more than 100 organizations and did not publish how many were breached, a distinction some downstream coverage collapses.¹⁷

Verification of Claims

1. Claim: RedFlick is a malware-delivery technique and CosmicPulse is the backdoor it deploys. → Verified → Microsoft's own analysis defines RedFlick as "a malware delivery technique that helps evade detection by initiating a set of scheduled tasks to deploy the actor's custom backdoor, CosmicPulse," a Python backdoor.¹

2. Claim: Star Blizzard is subordinate to Russia's FSB Centre 18. → Partially verified → This is an assessed attribution. The December 2023 Five Eyes advisory assessed Star Blizzard is "almost certainly subordinate to" FSB Centre 18, and Microsoft repeats CISA's attribution; it is a confidence-graded government judgment, not a forensic certainty.¹²

3. Claim: The activity affected more than 100 organizations, primarily in the US and UK. → Partially verified → Microsoft states it "observed this activity affect over 100 organizations primarily in the United States and United Kingdom." Microsoft did not publish how many were compromised; The Hacker News noted at least one machine was infected but the number of breached organizations was not disclosed.¹⁷

4. Claim: Star Blizzard has abandoned ClickFix in favour of RedFlick. → Partially verified → Microsoft calls RedFlick "a notable departure from the actor's previous use of ClickFix-based infection chains" for delivering CosmicPulse, but also says it "continues to observe some previously reported Star Blizzard phishing techniques throughout 2026," including Evilginx spear-phishing. RedFlick supersedes ClickFix as the primary CosmicPulse-delivery chain; the actor has not dropped all prior tradecraft.¹⁸

Timeline

Attack Anatomy

Initial access

Star Blizzard makes initial contact with an email, usually without an attachment, impersonating a trusted political, diplomatic, academic, or organizational figure, often as an invitation to a closed-door event (T1566.002).¹ For the higher-volume 2026 operations, the actor adopted a mass-mailing platform (tens to hundreds of messages per campaign) and created sender accounts on compromised CPanel- and WordPress-hosted websites, reusing one account name across multiple domains (T1584.004).¹ When a recipient engages, the actor replies with a password-protected RAR or ZIP archive, the password supplied as an image in the email (T1566.001).¹

Delivery and masquerading

In the mid-January 2026 variant, the archive contained a VHDX virtual disk — a container format that bypasses Mark-of-the-Web controls (T1553.005).¹ The VHDX shipped a malicious LNK file disguised as a PDF (T1036.008), plus a hidden directory holding a BAT script and a legitimate decoy PDF.¹ Opening the LNK launched conhost.exe in a hidden window and spawned cmd.exe to run the BAT (T1059.003).¹ The BAT opened the decoy PDF and invoked SSH.exe with PermitLocalCommand enabled to download and execute a remotely hosted MSI installer (T1202, T1105).¹ In the July 2026 chain, the LNK instead used conhost.exe and curl to download a PDF, after which a PowerShell payload searched the PDF for the magic header cAB, extracted the following 208 bytes of Base64, and executed the decoded command to fetch a further MSI (T1059.001, T1027.003, T1140).¹

Installation and persistence

The MSI installer (T1218.007) created scheduled tasks for persistence (T1053.005). In the January campaign a single task used control.exe to download and run a CosmicPulse downloader compiled as a Control Panel applet (CPL) DLL (T1218.002).¹ By April the installer created three tasks masquerading as legitimate network components (T1036.004): "Internet Quality Test Connection" beacons UTF-16/Base64-encoded host and user names to the C2 and can execute an attacker DLL via Control_RunDLL over a WebDAV UNC path; "Network Configuration Manager" prepares the WebDAV client used by the other tasks; and "System Health Monitor" uses control.exe to retrieve and execute the next stage from the hardcoded C2 (T1071.001).¹

CosmicPulse downloader and backdoor

The CPL DLL downloader — publicly also tracked as NOROBOT or BAITSWITCH — downloads two ZIP files to disk and writes an encrypted AES key to the registry at HKEY_CURRENT_USER\Software\Classes\.mollis (T1112).¹ One ZIP carries a Python 3.8 64-bit package and a bootstrapper; the bootstrapper reads the encrypted key, recovers it with an embedded key in AES-ECB mode, and decodes the CosmicPulse payload (also known as YESROBOT) from the second ZIP (T1140).¹ CosmicPulse itself is a Python backdoor whose capabilities Microsoft says are unchanged from prior versions, with minor changes to evade signatures.¹

Actions on objectives and exfiltration

The registration task exfiltrates basic host identifiers — network/computer name and username — to the C2 server, Base64-encoded (T1033, T1082, T1041), establishing the beachhead through which CosmicPulse operates for espionage collection consistent with the actor's longstanding objectives.¹

Threat Actor Profile

Name: Star Blizzard (Microsoft; formerly SEABORGIUM) Aliases: Callisto Group, COLDRIVER (Google), TA446 (Proofpoint), TAG-53 (Recorded Future), BlueCharlie, and "Dancing Salome" (Kaspersky)²³ Attribution confidence: Assessed. The December 2023 Five Eyes advisory assessed Star Blizzard is "almost certainly subordinate to" FSB Centre 18; Microsoft repeats CISA's attribution without a stated confidence qualifier.¹² Motivation: State-directed cyberespionage — credential theft and intelligence collection against targets aligned with Russian strategic interests, particularly those supporting Ukraine.¹²

Star Blizzard has operated since at least 2017 and is known for patient, research-heavy spear-phishing against journalists, NGOs, think tanks, academics, and former intelligence and defence officials.⁸ The December 2023 US indictment charged Ruslan Aleksandrovich Peretyatko — an FSB Centre 18 officer — and Andrey Stanislavovich Korinets with a computer-intrusion conspiracy running from at least October 2016 to October 2022; material from compromised UK accounts was leaked ahead of the 2019 UK election.³ In October 2024, a Microsoft civil action and a parallel DOJ seizure took down 107 of the actor's domains.⁵ Through 2025 the actor delivered malware via ClickFix-style fake-CAPTCHA lures (Google's COLDCOPY), and in 2026 pivoted to RedFlick while retaining Evilginx-based credential phishing and continuing to use free-provider accounts such as Proton in targeted operations.¹⁶

MITRE ATT&CK techniques (IDs verified live on attack.mitre.org):

OPSEC: Password-protected archives with the password sent as an image to defeat text-based scanning; VHDX containers and LNK-as-PDF masquerades to bypass Mark-of-the-Web and user suspicion; scheduled-task names impersonating Windows components; WebDAV-over-HTTP retrieval to avoid SMB; payloads concealed inside PDFs; steganography introduced in mid-August 2026; and compromised legitimate websites used for sender accounts.¹

Technical Indicators

file_hashes_sha256:
  - 9707a8694e954e9ee13e839d6e5905ce626c0837c7c90da6d1025bfbe152866b   # Documents.zip, January campaign (Ukraine)
  - 1f2096ff906915fbf80778f0636446206197351f7e271af97936eeb6f32c179d   # Documents.vhdx, January campaign (inside the ZIP above)
  - 699e92a9e0edf7835879d5697bc67138c0b137117f459caf1a44df357407cad9   # Chatham_London_Conference_2026_Invitation.rar, June (pwd: LiveCrown8142)
  - 24b6e36a09eb2acfc2a95478ca685acb7593b1689be6a4a639fe0d222393cfa7   # USUBC_Private_Executive_Roundtable_Webex.rar, July (pwd: LiteRaspberry9415)
  - dd98dbc1a55afe6fd0ed2ed53a79c76f6bde15081a0060422185b74eb1799ee4   # Payment Advice Note.zip, August (pwd: BirdMouseCrab)
domains:
  - etia[.]ca              # RedFlick MSI installer host, January
  - groy[.]cc              # RedFlick MSI installer host, February
  - muvb[.]net             # RedFlick MSI installer host, February
  - gliderrompercycl[.]com # CosmicPulse backdoor download
  - divekickspolic[.]org   # CosmicPulse backdoor download
  - matjk[.]click          # RedFlick MSI installer host, March
  - bpdaersa[.]click       # RedFlick MSI installer host, March
  - stuseamandesilt[.]org  # CosmicPulse backdoor download
  - Itechx[.]tel           # RedFlick MSI installer host, April
  - guach[.]net            # RedFlick PowerShell installer host, June
  - ruten[.]observer       # CosmicPulse downloader DLL host, June-July
  - byveo[.]org            # RedFlick PowerShell installer host, July
  - secure-dns-hub[.]com   # CosmicPulse downloader DLL host, July-current
  - qumel[.]link           # CosmicPulse downloader DLL host, July
  - cyrna[.]top            # RedFlick MSI installer host, August
  - drasw[.]club           # CosmicPulse downloader DLL host, August
ipv4:
  - 103.245.231[.]248      # CosmicPulse downloader DLL host, January
  - 2.57.241[.]246         # CosmicPulse downloader DLL host, February
  - 89.125.209[.]168       # CosmicPulse downloader DLL host, February
  - 103.245.231[.]79       # CosmicPulse downloader DLL host, March
  - 45.84.59[.]66          # CosmicPulse downloader DLL host, April
  - 103.160.59[.]97        # CosmicPulse downloader DLL host, July
registry_persistence:
  - 'HKEY_CURRENT_USER\Software\Classes\.mollis'   # encrypted AES key for CosmicPulse
scheduled_task_names:
  - 'Internet Quality Test Connection'   # beaconing + dynamic DLL execution
  - 'Network Configuration Manager'      # WebDAV client support
  - 'System Health Monitor'              # CosmicPulse downloader execution
host_binaries_abused:
  - conhost.exe
  - cmd.exe
  - ssh.exe   # invoked with PermitLocalCommand=yes, LocalCommand=cmd.exe
  - curl.exe
  - msiexec.exe
  - control.exe
note: >
  All indicators are from Microsoft Threat Intelligence's September 29, 2026 report.
  Archive passwords are listed as reported indicators (actor-supplied, delivered as
  images in the phishing emails), not as credentials to any live service. Microsoft
  warns that file names and infrastructure rotate between campaigns.

Legal and Regulatory Response

No new law-enforcement action, indictment, or sanction tied specifically to the 2026 RedFlick campaigns had been published as of October 6, 2026; Microsoft states it directly notifies targeted and compromised customers.¹ The actor is, however, the subject of substantial prior public action. On December 7, 2023, CISA, the UK NCSC, the FBI, the NSA, and allied agencies published advisory AA23-341a attributing Star Blizzard to FSB Centre 18; the US Department of Justice unsealed an indictment of FSB Centre 18 officer Ruslan Aleksandrovich Peretyatko and Andrey Stanislavovich Korinets for a global computer-intrusion conspiracy; and the US Treasury's OFAC and the UK sanctioned both men.²³⁴ On October 3, 2024, a Microsoft civil action and a parallel DOJ seizure took down 107 domains used by the actor (66 seized by Microsoft, 41 by the DOJ), with the supporting affidavit describing the group as a criminal proxy for an operational unit within FSB Centre 18.⁵ Charges remain allegations; the named individuals are outside US and UK jurisdiction and have not been tried.³

Impact Assessment

• Confirmed: Microsoft observed at least 13 distinct large-scale phishing campaigns between January and August 2026 using the RedFlick technique to deliver CosmicPulse.¹
• Reported, not independently confirmed: The activity affected over 100 organizations, primarily in the US and UK. This is Microsoft's own telemetry; the figure counts organizations observed affected, not confirmed breaches, and Microsoft did not disclose how many were compromised.¹⁷
• Reported, not independently confirmed: A March 2026 campaign delivered the DarkSword iOS backdoor via a link, as reported by Proofpoint; a mid-August 2026 campaign used steganography.¹
• Unknown: The number of successful CosmicPulse installations, the volume or nature of data exfiltrated, and the identities of affected organizations. Microsoft published no victim count beyond "over 100 organizations" affected.¹

Lessons and Defensive Recommendations

For SOC/defenders:

• Hunt for conhost.exe launching curl, and for ssh.exe invoked with PermitLocalCommand=yes and LocalCommand=cmd.exe — both are anomalous on most endpoints and were used by this actor in 2026.¹
• Alert on creation of scheduled tasks named "Internet Quality Test Connection", "Network Configuration Manager", or "System Health Monitor", and on writes to HKEY_CURRENT_USER\Software\Classes\.mollis.¹
• Treat control.exe loading a CPL from a remote or WebDAV UNC path, and msiexec installing MSIs fetched by ssh/curl, as high-signal; block or monitor outbound SSH to non-business destinations.¹
• Load the Microsoft IOC set (hashes, 16 domains, 6 IPs) into network and web-session detections, treating infrastructure as rotating.¹

For email and platform teams:

• Password-protected archives whose password arrives as an image evade text-based scanning; detonate or quarantine such attachments and flag archives containing VHDX/ISO or LNK files disguised as documents. Enable Mark-of-the-Web enforcement so container formats do not launder downloaded content.¹
• Watch for sender display names that reference a real person or organization while the registered domain does not match (the organization appears only in the local part of the address), a persistent Star Blizzard tell.¹

For leadership (at-risk sectors — Ukraine-nexus NGOs, think tanks, government, finance):

• Deploy phishing-resistant authentication and conditional access; this actor's core objective remains credential theft and account access, and it continues parallel Evilginx operations alongside RedFlick.¹⁸
• Assume the "100+ organizations affected" figure understates exposure for a reader's sector rather than overstates it: the number is Microsoft telemetry, not a confirmed breach count, and targeting is broad across Ukraine-aligned policy and finance bodies.¹⁷

Sources