# Star Blizzard (SEABORGIUM) RedFlick technique: scheduled-task backdoor delivery via phishing (CosmicPulse)

> Microsoft Threat Intelligence reports that Russian FSB Centre 18 actor Star Blizzard (SEABORGIUM/COLDRIVER) has shifted from targeted spear-phishing to large-scale phishing and uses the RedFlick technique, in which scheduled tasks deploy backdoors with fewer user interactions than earlier ClickFix chains. Payloads include the Python backdoor CosmicPulse (YESROBOT) and a Control Panel applet (CPL) downloader (NOROBOT/BAITSWITCH); more than 100 organizations were affected, primarily in Ukraine and then the US and UK.

- **Published:** 2026-09-29T00:00:00Z
- **Last reviewed:** 2026-10-01T22:41:15Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-2787
- **ID:** TL-2026-2787
- **Severity:** HIGH
- **Category:** APT
- **Status:** ACTIVE
- **Actor:** Star Blizzard (Russia)
- **Detections:** 9 · **IOCs:** 36 (full data via the Threadlinqs MCP server — Purple tier)

## Description

Microsoft Threat Intelligence (2026-09-29) describes how Star Blizzard, a Russian state actor assessed by CISA and partner agencies (AA23-341A) as almost certainly subordinate to FSB Centre 18, evolved during 2026 from manual, targeted spear-phishing to mass-mailing campaigns of tens to hundreds of emails per wave. Lures impersonate legitimate organizations: conference and roundtable invitations (IISS, Chatham House, Atlantic Council-themed, USUBC, MAMA Summit, Future of Liberty/Peace Operations forums), Ukrainian-language tax and fine-payment notices, a Kyiv water-supply outage notice aimed at hotels, and a payment advice note aimed at an international financial organization. From March 2026 onward the actor also created accounts on compromised cPanel/WordPress-hosted sites to send phishing. Targets include Ukrainian individuals, NGOs, think tanks, governments and financial institutions supporting Ukraine; over 100 organizations were affected, primarily in Ukraine and then the US and UK.

After a recipient replies, a follow-up email delivers a password-protected RAR/ZIP archive, with the password shown as an image to evade email filtering. The archive starts the RedFlick chain, which needs a single user interaction. In the January 2026 variant a ZIP holds a VHDX containing an LNK disguised as a PDF and a hidden BAT directory. The LNK launches a hidden conhost.exe and cmd.exe, and the BAT opens a decoy PDF and runs ssh.exe with PermitLocalCommand enabled to download an MSI from attacker infrastructure. The MSI creates a scheduled task that uses control.exe to fetch a CPL downloader (CosmicPulse downloader, aka NOROBOT/BAITSWITCH). In the July 2026 variant a RAR nested in a ZIP holds an LNK that uses conhost.exe and curl to download a PDF. PowerShell locates the magic header 'cAB' in the PDF, extracts 208 bytes of Base64 data, and decodes a command that downloads the MSI, which creates two scheduled tasks. In mid-August 2026 the actor added image-based/steganographic obfuscation.

From April 2026 persistence moved to three coordinated scheduled tasks masquerading as Windows components: 'Internet Quality Test Connection' (beacons a UTF-16 Base64 string containing network/computer name and username to the C2 and runs an attacker DLL via Shell32 Control_RunDLL from a WebDAV UNC path), 'Network Configuration Manager' (uses net.exe to prepare WebClient/WebDAV access) and 'System Health Monitor' (control.exe loads a remote CPL from a hardcoded C2, 103.245.213.217). The CPL downloader fetches two ZIPs: one holding a Python 3.8 64-bit package plus a bootstrapper, the other an encrypted CosmicPulse payload. An AES key is stored under HKCU\Software\Classes\.mollis, and the bootstrapper decrypts the payload with that key plus an embedded AES-ECB key and runs the CosmicPulse (YESROBOT) backdoor. Microsoft states the backdoor's capabilities are unchanged from earlier versions.

Context from Google Threat Intelligence Group (October 2025): after the May 2025 LOSTKEYS exposure, COLDRIVER developed the COLDCOPY ClickFix lure, the NOROBOT DLL downloader (rundll32 export humanCheck/verifyme) and the YESROBOT Python 3.8 backdoor (HTTPS, AES-encrypted commands, host identity in the User-Agent header), later replaced by the PowerShell backdoor MAYBEROBOT (SIMPLEFIX). Zscaler ThreatLabz independently documented BAITSWITCH/SIMPLEFIX in September 2025. Microsoft also notes DarkSword iOS backdoor delivery observed in a March 2026 Atlantic Council-themed lure (Proofpoint report). Microsoft Defender detects the activity as Trojan:Script/RedFlick, Backdoor:Script/CosmicPulse and Backdoor:Python/CosmicPulse, with behavioral alerts for suspicious LNK execution from a container, curl downloads, msiexec.exe behavior and Control Panel item use.

## MITRE ATT&CK

- T1566.001 Spearphishing Attachment
- T1566.002 Spearphishing Link
- T1204.002 Malicious File
- T1059.001 PowerShell
- T1059.003 Windows Command Shell
- T1059.006 Python
- T1053.005 Scheduled Task
- T1036.005 Match Legitimate Resource Name or Location
- T1218.002 Control Panel
- T1218.007 Msiexec
- T1140 Deobfuscate/Decode Files or Information
- T1027 Obfuscated Files or Information
- T1027.003 Steganography
- T1112 Modify Registry
- T1071.001 Web Protocols
- T1553.005 Subvert Trust Controls
- T1105 Ingress Tool Transfer
- T1557 Adversary-in-the-Middle
- T1539 Steal Web Session Cookie
- T1586.002 Compromise Accounts

## Sources

- [Star Blizzard refines phishing and malware delivery with the RedFlick technique](https://www.microsoft.com/en-us/security/blog/2026/09/29/star-blizzard-refines-phishing-and-malware-delivery-with-the-redflick-technique/)
- [Russian FSB Cyber Actor Star Blizzard Continues Worldwide Spearphishing Campaigns (AA23-341A)](https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-341a)
- [GTIG: Russian COLDRIVER develops new malware families (NOROBOT, YESROBOT, MAYBEROBOT)](https://cloud.google.com/blog/topics/threat-intelligence/new-malware-russia-coldriver/)
- [Zscaler ThreatLabz: COLDRIVER updates arsenal with BAITSWITCH and SIMPLEFIX](https://www.zscaler.com/blogs/security-research/coldriver-updates-arsenal-baitswitch-and-simplefix)
- [MITRE ATT&CK: Star Blizzard (G1033)](https://attack.mitre.org/groups/G1033)
- [UK NCSC: Russian FSB cyber actor Star Blizzard continues worldwide spear phishing campaigns](https://www.ncsc.gov.uk/pdfs/news/star-blizzard-continues-spear-phishing-campaigns.pdf)
- [Malpedia: NOROBOT (BAITSWITCH)](https://malpedia.caad.fkie.fraunhofer.de/details/win.norobot)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-2787