Star Blizzard refines phishing and malware delivery with the RedFlick technique

1. Executive summary

Star Blizzard (MITRE G1033), the Russian FSB Centre 18 actor, has moved from targeted spear-phishing to large-scale phishing campaigns and adopted a new delivery technique Microsoft tracks as RedFlick, which uses scheduled tasks to install the CosmicPulse Python backdoor after a single user interaction. Microsoft observed the activity affect over 100 organizations, primarily in the United States and United Kingdom, with targeting that includes financial institutions that have supported Ukraine politically or financially. The actor sends password-protected archives by email, uses accounts created on compromised WordPress and cPanel sites to send the lures, and has concealed payloads inside PDF files and VHDX containers. There is no CVE in this item and no CISA KEV entry; the risk is operational, not patchable, and it lands on email, endpoint and identity controls rather than on a version upgrade.

2. Regulatory framing

DORA Art. 17, 19, 24, 28, 29 and 30 and UK NIS 2018 are not engaged by the facts in this item as published.

3. Technical analysis & attack chain

Star Blizzard's 2026 activity is a delivery and persistence problem, not a vulnerability problem. Microsoft reports at least 13 distinct large-scale phishing campaigns since January 2026, each sending tens to hundreds of messages, against NGOs, think tanks, government organizations and financial institutions with a Ukraine nexus. The actor's shift from ClickFix chains to RedFlick reduces the infection to a single user interaction.

Confirmed attack chain, as reported by Microsoft:

1. Initial contact. The actor sends a phishing email, often impersonating a known political or diplomatic figure, a conference or event invitation from a think tank or NGO, or an internal communication from the target's own organization. Early 2026 campaigns against Ukr.net users impersonated Ukrainian authorities with tax audit or outstanding fine themes.
2. Follow-up delivery. Once the recipient replies, the actor sends a second email with a password-protected RAR or ZIP archive. The password is supplied as an image in the email body. Observed archive names include Chatham_London_Conference_2026_Invitation.rar, USUBC_Private_Executive_Roundtable_Webex.rar, Payment Advice Note.zip and Documents.zip.
3. Container execution. In the January 2026 variant, a VHDX file contains a malicious LNK disguised as a PDF, a hidden directory with a BAT script, and a legitimate decoy PDF. Opening the LNK launches conhost.exe in a hidden window, which spawns cmd.exe to run the BAT script.
4. First-stage download. The BAT script opens the decoy PDF and invokes SSH.exe with PermitLocalCommand enabled to download and execute a remotely hosted MSI installer. In the July 2026 variant, the LNK uses conhost.exe and curl to download a PDF from an actor-controlled server, then runs a PowerShell payload that searches the PDF for the magic header cAB, extracts the following 208 bytes of Base64 data and executes the decoded command, which downloads another MSI.
5. Persistence via RedFlick. The MSI installer creates scheduled tasks. By April 2026 the installer created three tasks masquerading as legitimate network components: - Internet Quality Test Connection: sends a UTF-16 and Base64-encoded string containing the host network or computer name and username to the C2 server, then executes an attacker-controlled DLL remotely via Control_RunDLL from Shell32.dll over a WebDAV UNC path. - Network Configuration Manager: prepares WebDAV client functionality so Windows processes the UNC path through the WebDAV redirector and WebClient over HTTP/HTTPS rather than SMB. - System Health Monitor: uses control.exe to reach a remote path on the hardcoded C2 server and execute the next stage.
6. CosmicPulse installation. A Control Panel applet DLL (also tracked as NOROBOT or BAITSWITCH) acts as the downloader. It writes an encrypted AES key to HKEY_CURRENT_USER\Software\Classes.mollis, downloads two ZIP files, and the bootstrapper recovers the key using an embedded key in AES-ECB mode to decode the CosmicPulse payload (also known as YESROBOT) from the second ZIP. One ZIP carries a Python 3.8 64-bit package and the bootstrapper. CosmicPulse is a Python backdoor; Microsoft reports its capabilities are unchanged from earlier reporting.

Two details matter for defenders. The WebDAV UNC path lets the actor retrieve payloads over HTTP instead of SMB, which defeats controls that only watch SMB egress. The CPL masquerade means the downloader runs as a Control Panel applet rather than as a conventional executable, which is why Microsoft's own detection names include "Suspicious use of Control Panel item".

Confidence and single-sourcing caveats. The RedFlick and CosmicPulse technical detail, the scheduled task names, the registry key and the IOC set all come from a single source, Microsoft's 2026-09-29 blog. Treat the IOC list as single-sourced and verify before enforcement. Microsoft states it assesses with high confidence that the WordPress and cPanel sites used to send phishing were compromised by Star Blizzard; that assessment is Microsoft's, not independently corroborated here. The actor's attribution to FSB Centre 18 is attributed by CISA and reported by Microsoft; MITRE records the actor as G1033. Microsoft also cites Proofpoint's March 2026 reporting that Star Blizzard targeted vulnerable Apple iOS devices to deploy the DarkSword backdoor, and Digital Security Lab Ukraine's June 2026 reporting of overlapping TTPs; Adverse Trace has not reviewed those reports directly.

4. Mitigation & containment

P1 (within 24 hours)

• Hunt for the three scheduled task names across endpoints and registry: Internet Quality Test Connection, Network Configuration Manager, System Health Monitor. Microsoft's advanced hunting query in the source covers DeviceProcessEvents, DeviceEvents and DeviceRegistryEvents for these strings. Any hit is a containment event.
• Check for the registry key HKEY_CURRENT_USER\Software\Classes.mollis. Its presence indicates the CosmicPulse downloader has run. Isolate the host, preserve the key and the two downloaded ZIP files, and treat the endpoint as compromised.
• Block the network indicators in §5 at the email gateway, web proxy and DNS resolver. Because the IOC set is single-sourced, run them as detection first and confirm against your own telemetry before adding them to a permanent deny list.
• Search mail logs for inbound password-protected archives with the observed filenames and for the subject themes (tax audit, outstanding fine, conference invitation, internal communication). Quarantine and trace any recipient who replied.
• Disable or restrict WebDAV client functionality where it is not operationally required. The WebClient service is the component the second scheduled task prepares; if your estate does not use WebDAV, turning it off removes the execution path.

P2 (within 72 hours)

• Block execution of Control Panel applets from user-writable and remote paths. The downloader masquerades as a CPL, so a rule that permits control.exe only from System32 closes the third task's execution route.
• Alert on conhost.exe spawning curl, and on ssh.exe invoked with PermitLocalCommand=yes and LocalCommand=cmd.exe. Both are Microsoft's own hunting queries from the source and both are low-noise in most financial services estates.
• Restrict outbound HTTP/HTTPS from endpoints to approved destinations. The RedFlick chain depends on reaching actor-controlled hosts for the MSI, the PDF and the CPL.
• Review mail flow for accounts created on third-party WordPress and cPanel domains. The actor reuses the same account name across multiple website domains, which is a usable detection pivot if your gateway logs sender account names.

P3 (within 7 days)

• Add the §6 YARA and Sigma rules to endpoint and SIEM detection. The Sigma rule targets the scheduled task creation and the conhost/curl and ssh.exe command lines.
• Confirm that email filtering strips or quarantines password-protected archives and that users cannot open VHDX files from email. The January chain depends on a VHDX container reaching the endpoint.
• Re-baseline which staff are publicly associated with Ukraine policy, NGO or think tank work, and apply heightened phishing awareness and out-of-band verification for conference and event invitations. The actor's lures impersonate exactly these contexts.

5. Indicators of compromise

All indicators below are from Microsoft's 2026-09-29 blog. Single-sourced; verify before enforcement.

sha256  9707a8694e954e9ee13e839d6e5905ce626c0837c7c90da6d1025bfbe152866b
sha256  1f2096ff906915fbf80778f0636446206197351f7e271af97936eeb6f32c179d
sha256  699e92a9e0edf7835879d5697bc67138c0b137117f459caf1a44df357407cad9
sha256  24b6e36a09eb2acfc2a95478ca685acb7593b1689be6a4a639fe0d222393cfa7
sha256  dd98dbc1a55afe6fd0ed2ed53a79c76f6bde15081a0060422185b74eb1799ee4
domain  etia[.]ca
ipv4  103.245.231[.]248
domain  groy[.]cc
ipv4  2.57.241[.]246
domain  gliderrompercycl[.]com
domain  muvb[.]net
ipv4  89.125.209[.]168
domain  divekickspolic[.]org
domain  matjk[.]click
domain  bpdaersa[.]click
ipv4  103.245.231[.]79
domain  stuseamandesilt[.]org
domain  Itechx[.]tel
ipv4  45.84.59[.]66
domain  guach[.]net
domain  ruten[.]observer
domain  byveo[.]org
domain  secure-dns-hub[.]com
ipv4  103.160.59[.]97
domain  qumel[.]link
domain  cyrna[.]top
domain  drasw[.]club

Behavioural indicators

6. Detection

YARA rule for the RedFlick and CosmicPulse artefacts named in the source.

rule RedFlick_CosmicPulse_Artefacts
{
    meta:
        author = "Adverse Trace"
        date = "2026-09-29"
        reference = "https://www.microsoft.com/en-us/security/blog/2026/09/29/star-blizzard-refines-phishing-and-malware-delivery-with-the-redflick-technique/"
        description = "Detects strings associated with Star Blizzard RedFlick scheduled tasks, CosmicPulse downloader and delivery containers"
    strings:
        $task1 = "Internet Quality Test Connection" ascii wide
        $task2 = "Network Configuration Manager" ascii wide
        $task3 = "System Health Monitor" ascii wide
        $regkey = "Software\\Classes\\.mollis" ascii wide
        $cpl = "Control_RunDLL" ascii wide
        $pdfmagic = "cAB" ascii
        $ssh1 = "PermitLocalCommand=yes" ascii wide
        $ssh2 = "LocalCommand=cmd.exe" ascii wide
    condition:
        uint16(0) == 0x5A4D and 2 of them
}

Sigma rule for the scheduled task persistence and the two download command lines.

title: Star Blizzard RedFlick Scheduled Task Persistence and Download Activity
id: 6f2a1c74-9d3e-4b21-8a55-0c7e5b1d9f30
status: experimental
description: Detects Star Blizzard RedFlick scheduled tasks masquerading as network components, and the conhost/curl and ssh.exe download command lines reported by Microsoft
author: Adverse Trace
date: 2026-09-29
references:

    - https://www.microsoft.com/en-us/security/blog/2026/09/29/star-blizzard-refines-phishing-and-malware-delivery-with-the-redflick-technique/
logsource:
    product: windows
    category: process_creation
detection:
    selection_tasks:
        CommandLine|contains:

            - 'Internet Quality Test Connection'
            - 'Network Configuration Manager'
            - 'System Health Monitor'
    selection_curl:
        Image|endswith: '\conhost.exe'
        CommandLine|contains: 'curl'
    selection_ssh:
        CommandLine|contains|all:

            - 'ssh.exe'
            - 'PermitLocalCommand=yes'
            - 'LocalCommand=cmd.exe'
    condition: 1 of selection_*
falsepositives:

    - Legitimate administrative scripts that create scheduled tasks with these display names
    - Software deployment tooling that invokes curl from a console host
level: high

Threat actor context

Star Blizzard · G1033 · aka SEABORGIUM, Callisto Group, TA446, COLDRIVER

Star Blizzard is a cyber espionage and influence group originating in Russia that has been active since at least 2019. Star Blizzard campaigns align closely with Russian state interests and have included persistent phishing and credential theft against academic, defense, government, NGO, and think tank organizations in NATO countries, particularly the US and the UK.

7. Sources

• Microsoft Security Blog, "Star Blizzard refines phishing and malware delivery with the RedFlick technique", https://www.microsoft.com/en-us/security/blog/2026/09/29/star-blizzard-refines-phishing-and-malware-delivery-with-the-redflick-technique/, 2026-09-29.

8. Adverse Trace position

Adverse Trace assesses this as a high-priority espionage campaign for EMEA financial services clients with any public Ukraine nexus, and a lower but non-zero risk for the wider sector because the delivery chain depends on email, archive handling and WebDAV, all of which are common in corporate estates. There is no CVE and no CISA KEV entry to drive a patch cycle; the exposure is the single-interaction infection flow and the CPL and WebDAV execution paths, which most endpoint controls do not watch by default. The technical detail and the IOC set are single-sourced to Microsoft, so we treat the indicators as detection-grade rather than block-grade until a second source corroborates them, and we note that the actor attribution to FSB Centre 18 rests on CISA's assessment as reported by Microsoft. We will re-issue this advisory if a second vendor publishes independent IOCs or if Microsoft updates the campaign scope, and we will run the §5 indicators against client telemetry on request.

Read the original source →

Published via PulseTrace — Adverse Trace threat intelligence.