# Star Blizzard (FSB) RedFlick mass-phishing campaigns deliver CosmicPulse backdoor, expanding beyond Ukraine

> Microsoft reports that Russian FSB-affiliated Star Blizzard (SEABORGIUM, Callisto Group, TA446, COLDRIVER) shifted from targeted spear-phishing to mass-mailing, running at least 13 large campaigns since January 2026 against 100+ organizations, mainly in the US and UK plus Ukrainian entities. The RedFlick delivery technique uses LNK/VHDX/MSI chains and scheduled tasks to deploy the custom Python backdoor CosmicPulse after a single user interaction.

- **Published:** 2026-09-29T00:00:00Z
- **Last reviewed:** 2026-10-01T22:41:19Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-2795
- **ID:** TL-2026-2795
- **Severity:** HIGH
- **Category:** APT
- **Status:** ACTIVE
- **Actor:** Star Blizzard (Russia)
- **Detections:** 9 · **IOCs:** 33 (full data via the Threadlinqs MCP server — Purple tier)

## Description

On 2026-09-29 Microsoft Threat Intelligence published analysis of Star Blizzard's new RedFlick malware delivery technique. Star Blizzard, attributed to the Russian FSB (Centre 18, per CISA advisory AA23-341A), historically ran low-volume, targeted credential-phishing spear-phishing. Since January 2026 Microsoft counted at least 13 larger campaigns, each with tens to hundreds of emails - a scale not previously seen from the actor - affecting more than 100 organizations, mostly in the United States and United Kingdom, in government, diplomacy, research/think tanks, NGOs, public policy, journalism and financial sectors tied to Ukraine. January-February 2026 campaigns focused on Ukrainian targets; from March 2026 targeting broadened globally.

Lures were varied: Ukrainian tax-audit result notifications and fine-payment debit notices, exclusive event invitations (IISS, CES, Atlantic Council, Chatham House, USUBC roundtable, Ukraine Recovery Conference), M&A and diplomatic-forum discussions, Kyiv hotel water-supply shutdown notices, and 'Payment Advice Note' messages to international financial organizations. Mail was sent from accounts the actor created on compromised cPanel/WordPress websites (reusing account names across compromised domains), a departure from earlier reliance on Proton Mail and Microsoft consumer accounts. Initial messages were often attachment-free; a follow-up delivered a password-protected RAR/ZIP (nested ZIP-in-RAR also seen), with the password supplied as an image in the email.

January 2026 chain: password-protected ZIP containing a VHDX holding a malicious LNK disguised as a PDF, a hidden BAT script and a decoy PDF. Opening the LNK launches conhost.exe hidden, cmd.exe runs the BAT, the decoy PDF opens, and ssh.exe is abused with PermitLocalCommand/LocalCommand to download an MSI from actor infrastructure. The MSI uses control.exe to create a scheduled task that pulls a CosmicPulse CPL downloader (Control Panel applet DLL; tracked as NOROBOT/BAITSWITCH/YESROBOT lineage in reporting). By April 2026 the MSI created three scheduled tasks: 'Internet Quality Test Connection' (sends Base64/UTF-16-encoded computer name, network name and username to C2 and runs remote DLLs via Shell32 Control_RunDLL over WebDAV UNC paths), 'Network Configuration Manager' (invokes net.exe to start WebClient/WebDAV) and 'System Health Monitor' (control.exe to run CosmicPulse downloader stages from C2). In July 2026 a variant used an LNK that ran conhost.exe with curl to fetch a PDF from the actor's server; PowerShell located the magic header 'cAB' in the PDF, extracted 208 bytes of Base64, decoded and executed it to download and install the MSI.

CosmicPulse is a Python-based backdoor: the CPL downloader retrieves two ZIPs from C2 - the first with a Python 3.8 64-bit package and bootstrapper, the second with an encrypted CosmicPulse payload. The bootstrapper reads an encrypted AES key from HKCU\Software\Classes\.mollis, decrypts it with AES-ECB using an embedded key, decodes the payload and runs it, giving the operator remote command execution and persistent access. Microsoft detections: Trojan:Script/RedFlick, Backdoor:Script/CosmicPulse, Backdoor:Python/CosmicPulse, plus behavioral alerts for suspicious LNK execution from a container, curl download, msiexec and Control Panel item use. C2 infrastructure rotated roughly monthly; secure-dns-hub.com remained active as of 2026-09-29.

## MITRE ATT&CK

- T1583.001 Domains
- T1584 Compromise Infrastructure
- T1566.001 Spearphishing Attachment
- T1204.002 Malicious File
- T1059.003 Windows Command Shell
- T1059.001 PowerShell
- T1059.006 Python
- T1053.005 Scheduled Task
- T1036.008 Masquerade File Type
- T1564.003 Hidden Window
- T1202 Indirect Command Execution
- T1218.002 Control Panel
- T1218.007 Msiexec
- T1140 Deobfuscate/Decode Files or Information
- T1082 System Information Discovery
- T1033 System Owner/User Discovery
- T1071.001 Web Protocols
- T1036.005 Match Legitimate Resource Name or Location
- T1027 Obfuscated Files or Information
- T1112 Modify Registry
- T1105 Ingress Tool Transfer
- T1041 Exfiltration Over C2 Channel

## Sources

- [Star Blizzard refines phishing and malware delivery with the RedFlick technique (Microsoft Security Blog)](https://www.microsoft.com/en-us/security/blog/2026/09/29/star-blizzard-refines-phishing-and-malware-delivery-with-the-redflick-technique/)
- [Russian hackers Star Blizzard expand targeting, change up tactics to reach Ukraine and beyond (CyberScoop)](https://cyberscoop.com/microsoft-star-blizzard-redflick-phishing-campaigns/)
- [Russia's Star Blizzard Targets 100+ Organizations With Fake Event Invites to Deliver Backdoor (The Hacker News)](https://thehackernews.com/2026/09/russias-star-blizzard-targets-100.html)
- [Star Blizzard scales phishing operations with RedFlick malware delivery (Field Effect)](https://fieldeffect.com/blog/star-blizzard-scales-phishing-operations)
- [Star Blizzard RedFlick Phishing Uses Windows Tools to Deploy CosmicPulse Backdoor (WindowsForum)](https://windowsforum.com/news/star-blizzard-redflick-phishing-uses-windows-tools-to-deploy-cosmicpulse-backdoor.446524/)
- [Star Blizzard Expands Phishing With RedFlick and New Backdoor Delivery Chains (Mallory)](https://mallory.ai/stories/01a0ee2c-1382-7e67-9057-71aede3c2e7d)
- [Star Blizzard refines phishing and malware delivery with the RedFlick technique (TheWindowsUpdate mirror)](https://thewindowsupdate.com/2026/09/29/star-blizzard-refines-phishing-and-malware-delivery-with-the-redflick-technique/)
- [Russian FSB Cyber Actor Star Blizzard Continues Worldwide Spearphishing Campaigns (CISA AA23-341A)](https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-341a)
- [Star Blizzard increases sophistication and evasion in ongoing attacks (Microsoft Security Blog)](https://microsoft.com/security/blog/2023/12/07/star-blizzard-increases-sophistication-and-evasion-in-ongoing-attacks)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-2795