Microsoft Threat Intelligence has detailed a major evolution in the phishing operations of Star Blizzard, a Russian state threat actor associated by CISA with the Russian Federal Security Service (FSB) Centre 18.
During 2026, Microsoft observed the group move beyond its traditionally targeted spear-phishing activity and begin conducting larger-scale phishing campaigns. At least 13 distinct campaigns were observed between January and August, affecting more than 100 entities, primarily in the United States and United Kingdom, alongside Ukrainian targets and entities associated with support for Ukraine.
The campaigns introduced a new malware delivery technique tracked by Microsoft as RedFlick. The technique ultimately deploys CosmicPulse, a Python-based backdoor, while using legitimate Windows components, scheduled tasks, disguised files and compromised web infrastructure to reduce detection opportunities.
The most important change is the reduction in user interaction. Unlike earlier ClickFix-based attacks that required victims to perform several manual steps, the RedFlick infection flow can be triggered with a single user interaction.
What is the Star Blizzard RedFlick campaign?
Star Blizzard has historically relied heavily on highly targeted phishing and social engineering, often impersonating trusted contacts or individuals relevant to the target.
Microsoft observed a significant change in 2026.
Instead of limiting operations to small numbers of carefully selected targets, the group began sending tens to hundreds of phishing emails per campaign. Microsoft identified at least 13 large-scale campaigns between January and August 2026.
The targets included:
- Government entities
- Think tanks
- NGOs
- Security researchers
- Academic institutions
- Media
- Financial institutions
- Diplomatic and policy-related entities
- Individuals and entities associated with Ukraine
The initial campaigns in January and February focused on users in Ukraine and used themes such as tax audit notifications and outstanding fines.
From March onward, targeting expanded internationally, with many campaigns using invitations to conferences, roundtables and private discussions supposedly hosted by well-known think tanks or NGOs.
How does the phishing campaign work?
One notable aspect of the campaign is that the first email may not contain malware at all.
Microsoft observed a multi-stage communication process:
Initial phishing email
↓
Target responds
↓
Password-protected RAR/ZIP archive sent
↓
Archive contains RedFlick components
↓
Malicious LNK/VHDX execution
↓
MSI installer
↓
Scheduled tasks
↓
CosmicPulse downloader
↓
CosmicPulse Python backdoor
The follow-up email typically contains a password-protected RAR or ZIP archive. The password is supplied separately as an image within the email.
This approach creates several defensive challenges.
The initial message may look like normal business correspondence. The malicious archive only arrives after the recipient engages with the attacker, and password-protected archives can reduce the visibility available to security controls that cannot inspect their contents.
Why are the phishing lures effective?
The group has continued to rely on trusted-context social engineering rather than obviously malicious messages.
Microsoft observed lures involving:
- Private security roundtables
- Technology-sector events
- Closed-door strategic discussions
- Think-tank conferences
- Diplomatic forums
- Financial discussions
- Tax audit notifications
- Payment notices
- Local infrastructure notices
Some messages were also crafted to appear as though they originated from within the target's own company or organization.
This is important because the attack does not depend solely on a suspicious attachment or obviously malicious URL.
The attacker first attempts to create a believable communication context.
Only after the recipient engages does the malware delivery stage begin.
How does the RedFlick infection chain work?
The RedFlick technique has evolved through several versions during 2026.
In one January campaign, Microsoft observed a password-protected ZIP archive containing a VHDX virtual disk image.
The VHDX contained:
- A malicious LNK file disguised as a PDF
- A hidden BAT script
- A legitimate decoy PDF
When the victim opened the LNK file, conhost.exe was launched in a hidden window and cmd.exe executed the embedded BAT script.
The script opened the decoy PDF to make the activity appear legitimate while also invoking ssh.exe with PermitLocalCommand enabled to download and execute an MSI installer.
The MSI installer then created a scheduled task that used control.exe to retrieve and execute the next stage.
This is a key characteristic of the campaign:
The attack does not necessarily require a custom executable to perform every stage.
Instead, Star Blizzard abuses legitimate Windows functionality to move through the infection chain.
What is CosmicPulse?
CosmicPulse is a Python-based backdoor used by Star Blizzard.
Microsoft observed the RedFlick downloader masquerading as a Control Panel applet DLL (CPL). The downloader retrieves, installs, and executes CosmicPulse on the compromised system. Microsoft also tracks related downloader tooling under names including NOROBOT and BAITSWITCH.
The installation process includes several layers.
The downloader retrieves two ZIP archives and stores them on the system. One contains a Python 3.8 64-bit environment and a bootstrapper, while another contains the encrypted CosmicPulse payload.
The bootstrapper retrieves an encrypted AES key from:
HKEY_CURRENT_USER\Software\Classes\.mollis
It then uses an embedded key and AES-ECB processing to recover the key and decode the CosmicPulse payload, also referred to as YESROBOT in Microsoft's analysis.
Microsoft has observed changes to CosmicPulse since January 2026 designed to circumvent existing signatures, although the backdoor's overall capabilities and purpose have remained consistent.
Star Blizzard expanded persistence with scheduled tasks
By April 2026, Microsoft observed Star Blizzard expanding its use of scheduled tasks.
Instead of creating a single task, an MSI installer created three scheduled tasks designed to resemble legitimate Windows network components:
- Internet Quality Test Connection
- Network Configuration Manager
- System Health Monitor
These tasks had different purposes within the attack chain.
The first task collected basic information about the infected system, including the network or computer name and username, and sent the information to the command-and-control infrastructure.
It could also execute an attacker-controlled DLL remotely through Control_RunDLL.
The second task supported WebDAV-based execution.
The third task used control.exe to retrieve and execute the CosmicPulse downloader from remote infrastructure.
This combination provides the attacker with persistence, remote payload execution and a degree of concealment behind legitimate Windows functionality.
Star Blizzard also hid payloads inside PDF files
In July 2026, Microsoft observed another modification to the infection chain.
The phishing archive contained an LNK file that used conhost.exe and curl to download a PDF from attacker-controlled infrastructure.
The PDF was not simply a document.
A PowerShell payload searched the file for a specific marker, extracted Base64-encoded data and executed the decoded command. The resulting command attempted to download and install another MSI package, which then created additional scheduled tasks.
This technique demonstrates why file extensions alone are not enough to establish whether a document is safe.
A file that appears to be a PDF may form part of a much larger execution chain involving:
LNK → PDF → PowerShell → MSI → Scheduled Task → CPL → CosmicPulse
Microsoft specifically noted the actor's use of PDFs to conceal payloads as part of its effort to bypass layered security controls.
Why is the RedFlick approach concerning?
The most significant change is not a single malware component.
It is the reduction in friction throughout the attack chain.
Earlier Star Blizzard ClickFix campaigns required victims to perform several manual actions before malware could be installed.
RedFlick reduces that requirement to a single user interaction.
At the same time, the campaigns have become larger, with Microsoft observing tens to hundreds of messages per campaign.
The group is also using compromised websites to create email accounts for phishing operations. Microsoft assesses with high confidence that websites hosted on platforms such as cPanel and WordPress were compromised for this purpose.
This gives the attacker several advantages:
- Higher phishing volume
- More credible sender infrastructure
- Reduced dependence on disposable email services
- Fewer required victim actions
- Greater use of legitimate Windows components
- Multiple persistence mechanisms
- Payload concealment inside apparently legitimate files
The result is a phishing operation that combines social engineering, compromised infrastructure, living-off-the-system techniques and malware delivery into a single workflow.
What should companies do?
Companies that may be targeted by Star Blizzard should treat this as both an email security and endpoint detection problem.
✅ Strengthen phishing-resistant authentication
Use phishing-resistant authentication methods where possible, particularly for privileged accounts and users with access to sensitive systems.
Microsoft also recommends Conditional Access policies to restrict account access based on identity and device signals.
✅ Inspect password-protected archives
Do not automatically treat password-protected ZIP or RAR files as trusted simply because they arrive during an existing email conversation.
A particularly important pattern is:
Unexpected invitation → recipient responds → password-protected archive arrives
This sequence should receive additional scrutiny.
✅ Monitor LNK execution
Microsoft observed LNK files disguised as PDFs throughout the RedFlick campaigns.
Security teams should monitor for suspicious LNK execution, especially when the shortcut launches:
conhost.execmd.execurlpowershell.exemsiexec.execontrol.exe
Microsoft Defender provides detections for suspicious LNK execution and related process activity.
✅ Monitor suspicious scheduled tasks
Scheduled tasks that appear to imitate legitimate Windows components deserve investigation.
The task names observed by Microsoft include:
Internet Quality Test ConnectionNetwork Configuration ManagerSystem Health Monitor
These names alone should not be treated as proof of compromise. Microsoft notes that its hunting queries can generate legitimate matches, so detections need to be investigated in context.
✅ Monitor unusual use of Windows utilities
The campaign demonstrates how legitimate tools can become part of a malicious execution chain.
Particular attention should be paid to unusual combinations involving:
conhost.exe → curl
ssh.exe → PermitLocalCommand
control.exe → remote path
msiexec.exe → scheduled task creation
Microsoft has published hunting queries specifically for several of these behaviors.
✅ Enable endpoint and email protections
Microsoft recommends advanced anti-phishing controls, Safe Links, Safe Attachments, EDR in block mode, real-time protection, network protection and continuous monitoring of suspicious authentication activity.
Companies should also ensure that security telemetry covers both email activity and endpoint process execution.
A malicious archive may initially evade email inspection, while the subsequent LNK, PowerShell, MSI or scheduled-task activity can provide stronger endpoint detection opportunities.
What should security teams hunt for?
Microsoft has published specific detection guidance for the campaign.
One hunting pattern looks for conhost.exe launching curl, which was observed when Star Blizzard used a malicious LNK to download a decoy PDF.
Another looks for ssh.exe combined with:
PermitLocalCommand=yes
and
LocalCommand=cmd.exe
Microsoft also provides hunting logic for the three scheduled-task names observed in the April campaign.
Network teams can additionally review connections to the infrastructure and indicators published by Microsoft, while recognizing that indicators can change as attacker infrastructure rotates.
For incident response, behavioral detection is therefore important alongside static indicators such as domains, IP addresses and file hashes.
The bigger cybersecurity lesson
The Star Blizzard campaign demonstrates how modern phishing attacks increasingly blur the line between email security, identity security and endpoint security.
The initial email may contain no malware.
The follow-up archive may be password-protected.
The malicious file may look like a PDF.
The execution chain may rely heavily on legitimate Windows utilities.
Persistence may be implemented through scheduled tasks.
And the final payload may be several stages removed from the original phishing email.
This means blocking known malicious attachments alone is not enough.
Companies need visibility across the complete chain:
Email → Identity → Endpoint → Process execution → Persistence → Network communication
The RedFlick campaign also highlights an important distinction between malware detection and attack-chain detection.
Even when a particular payload variant changes enough to avoid a static signature, the attacker may still need to perform recognizable actions such as creating scheduled tasks, launching suspicious child processes, retrieving remote payloads or executing Control Panel applets.
Those behaviors can provide valuable detection opportunities.
Final thoughts
Star Blizzard's 2026 activity represents a significant evolution in its phishing and malware-delivery operations.
Microsoft observed the group expand from highly targeted spear-phishing toward larger campaigns affecting more than 100 entities, while simultaneously introducing the RedFlick delivery technique and refining CosmicPulse deployment.
The important lesson for security teams is that the attack does not depend on one malicious file or one vulnerability.
It is a layered operation combining social engineering, compromised infrastructure, password-protected archives, disguised LNK files, legitimate Windows utilities, scheduled tasks and a Python backdoor.
For companies operating in sectors likely to be targeted, effective defense requires the same layered approach: phishing-resistant identity controls, strong email security, endpoint telemetry, behavioral detection and continuous monitoring.
The objective is not simply to recognize the Star Blizzard name. It is to detect the behaviors that make the RedFlick infection chain possible—and stop the attack before CosmicPulse establishes a foothold.
