Microsoft says Russia’s Star Blizzard is using a new 'RedFlick' phishing chain to install CosmicPulse malware

Microsoft says the Russian state-backed group Star Blizzard has changed how it infects victims, using larger phishing campaigns and a new malware-delivery chain called RedFlick. The group targets Ukrainian individuals and institutions, plus governments, NGOs, think tanks, academia, defense organizations, and financial institutions supporting Ukraine. After a victim replies to an email, attackers send a password-protected archive containing a VHDX disk image with a disguised LNK shortcut that opens a decoy PDF while running PowerShell or scripts in the background, fetching MSI installers, creating scheduled tasks for persistence, and deploying NoroBot or BaitSwitch to install the CosmicPulse Python backdoor.

Why it matters: Organizations tied to Ukraine or supporting it should treat unexpected follow-up emails and password-protected attachments as high risk and hunt for suspicious VHDX files, LNK shortcuts, MSI downloads, and fake scheduled tasks. This matters because it shows a known Russian espionage actor adapting around defenses, which can raise the chance of successful compromise even with a single user click.

Sources

Russian state hackers use new RedFlick technique to push malware

Bill Toulas 2026.09.30 99% relevant

This article is a direct report on the same Microsoft-disclosed Star Blizzard campaign, adding detail on the RedFlick delivery chain: password-protected archives containing a VHDX and LNK lure, MSI-installed scheduled tasks, NOROBOT/BAITSWITCH downloader stages, and CosmicPulse deployment against Ukraine-linked targets and supporting organizations.

Russian FSB-linked hackers scale up phishing attacks against Ukraine supporters

2026.09.30 98% relevant

This article is a direct update on the same Star Blizzard/RedFlick/CosmicPulse campaign, adding that Microsoft has seen at least 13 large-scale campaigns since January 2026, more than 100 affected organizations mainly in the U.S. and UK, early targeting of Ukr.net users with fake tax-audit and fine lures, and expanded targeting of NGOs, think tanks, governments, and financial institutions supporting Ukraine.

Russian APT Star Blizzard Uses ‘RedFlick’ Infection Chain in Recent Attacks

Ionut Arghire 2026.09.30 100% relevant

This article establishes a distinct campaign update centered on Star Blizzard's new RedFlick infection chain and CosmicPulse deployment, not a previously tracked specific incident.