Russian state hackers are using the new RedFlick technology to spread malware

Russian state actor Star Blizzard is using a new malware installation tactic called “RedFlick” to deploy its signature CosmicPulse backdoor.

While the tactic is not a new cybersecurity technique, it is a new delivery approach for the threat actor, allowing them to further automate attacks and reduce interaction with victims.

Microsoft researchers say that in 2026, Star Blizzard has expanded its phishing activities and optimized the distribution of malware.

Star Blizzard, active since 2017, is known for exploring new ways of payload delivery such as ClickFix or WhatsApp and continuously developing and deploying new families of malware.

New RedFlick technology

RedFlick attacks begin with a phishing email, such as an invitation, followed by a second message containing a password-protected ZIP or RAR archive.

The archive contains a VHDX virtual disk with an LNK file disguised as a PDF. When the file is opened, it launches a command in a hidden window while simultaneously displaying a tempting PDF file to the victim.

The commands download and run an MSI installer that creates three scheduled tasks masquerading as legitimate maintenance components, each with a specific purpose:

1. Internet quality test connection: sends the computer/network name and username to the attackers and can execute a remote DLL.
2. Network configuration manager: Prepares Windows’ WebDAV functionality so that remote web resources can be accessed via file paths.
3. System health monitor: uses control.exe to execute a remotely hosted next-stage payload.

Since the new method uses multiple scheduled tasks with different roles, it helps the attacker evade detection at different stages of the attack.

The next stage payload is a downloader called NOROBOT and BAITSWITCH, delivered in the form of a control panel applet (.cpl). Its purpose is to retrieve and execute the CosmicPulse backdoor.

BAITSWITCH downloads two ZIP archives, one containing the Python 3.8 64-bit package and a Python file that acts as a bootstrapper for CosmicPulse.

“The bootstrapper reads the encrypted key from the registry, recovers it using an embedded key in AES-ECB mode, and then uses the recovered key to decode the CosmicPulse payload.” Microsoft says.

Microsoft notes that the capabilities of the backdoor remain the same in the attacks observed, as described in a Report from Google in October 2025, including executing attacker-provided Python code to download and execute files or retrieve documents from infected systems.

From a practical perspective, RedFlick only requires the victim to open the malicious shortcut file to trigger an automated infection chain, while Star Blizzard’s ClickFix attacks required victims to perform several manual actions.

Microsoft’s report provides a technical analysis of the infection chain and the components used in the attacks.

The company said it has observed at least 13 different large-scale phishing campaigns since the start of the year, affecting more than 100 organizations, primarily in the US and UK.

“The RedFlick campaigns targeted Ukrainian individuals and institutions, as well as international NGOs, think tanks, governments and financial institutions that have provided political or financial support to Ukraine,” the researchers say.

Despite changing its tactics, techniques and procedures, StarBlizzard continues to target users by impersonating trusted contacts or organizations and continues to rely on free email providers to deliver phishing messages.

Microsoft recommends that organizations use phishing-resistant authentication, conditional access policies, and email protection, and independently review suspicious messages using established contact information.

Additionally, using an Endpoint Detection and Response (EDR) solution in block mode should prevent infections by blocking malicious artifacts even if they are not caught by the antivirus agent.