Microsoft says Russia-linked group Star Blizzard sent realistic event invitations to people and organizations tied to Ukraine, then used shortcut files and MSI installers to create scheduled tasks that fetch a Python backdoor named CosmicPulse.
Star Blizzard sent password-protected archives and malicious links in reply chains to more than 100 organizations tied to Ukraine since January 2026.
The group’s RedFlick technique uses LNK shortcuts and MSI packages to create scheduled tasks that download and run the CosmicPulse backdoor.
Defensive steps include checking sender domains, hunting for three specific scheduled-task names, and blocking known indicators Microsoft published.
What Star Blizzard sent and why it looked convincing
Technique evolution and infrastructure
Microsoft calls the 2026 installation approach RedFlick. Earlier Star Blizzard methods used free consumer email services and, in 2025, fake CAPTCHA pages (ClickFix) that tricked users into running commands. In 2026, Microsoft saw at least 13 larger RedFlick campaigns plus routine targeted phishing. Since March, campaigns increasingly used email accounts on WordPress and cPanel sites Microsoft believes were hacked for this purpose.
Microsoft and other reporting note overlap between RedFlick activity and a June campaign targeting Ukrainian civil society groups (reported by Digital Security Lab Ukraine). Two overlapping indicators are IP 103.160.59[.]97 and domain secure-dns-hub[.]com. Microsoft left secure-dns-hub[.]com active in its indicators at publication time (September 29, 2026).
Recipients are people and organizations tied to Ukraine policy, reconstruction, civil society, and international affairs. Named lures included fake tax audit notices to Ukr.net users, hotel water-shutdown notices in Kyiv, and payment notices for staff of an international financial organization.
Microsoft published hunting queries and indicators. Practical checks for organizations Microsoft identified as likely targets:
Star Blizzard shifted techniques to a scheduled-task–based installation chain (RedFlick) to install CosmicPulse. The social engineering used realistic event invitations and reply-based escalation, increasing the chance that targets would open attachments or follow links. Organizations working on Ukraine-related policy or assistance should prioritize sender verification and the specific artifact hunts Microsoft recommended.
The Russian state actor Star Blizzard has been using a new malware installation tactic dubbed "RedFlick" to deploy its signature CosmicPulse backdoor. [...]
Russian state-linked threat actor Star Blizzard has expanded its cyberespionage operations in 2026 with a phishing and malware-delivery technique tracked by Microsoft as RedFlick. Microsoft Threat Intelligence reported that the group, which CISA attributes to Russia’s Federal Security Service (FSB) Center 18, conducted
Russian state-sponsored threat actor BlueDelta, also tracked as APT28, Fancy Bear, and Forest Blizzard, has deployed a lightweight Windows backdoor named HOOKEDGE in espionage operations targeting government, diplomatic, and defense-manufacturing organizations across Europe. The activity, documented by PolySwarm, targe
A Russian national has been extradited to the United States to face charges over an alleged phishing operation that used 255 fake accounts on a freelance employment platform to distribute malicious Microsoft Excel files to roughly 80,000 users. Federal prosecutors allege that Searzhudin Tamirlanovich Aktulaev, 40, orch
Born from the lessons of Ukraine, Rassvet promises secure battlefield communications, Arctic coverage, and independence from foreign technology On the night of August 15, 2026, the industrial outskirts of Samara lit up as Ukrainian long-range Flamingo missiles targeted factory buildings. By morning, news appeared onlin
Loading more related stories...
Open the app view to save this story, compare related coverage, and continue from the same source.