Star Blizzard Expands Phishing Operations With New RedFlick Malware Delivery Technique

Microsoft Threat Intelligence says the Russian state-linked threat actor known as Star Blizzard has significantly changed parts of its phishing and malware-delivery tradecraft during 2026.

In a September 29, 2026 research report, Microsoft described a shift from highly targeted spear-phishing toward larger-scale phishing campaigns, the use of accounts created on compromised websites, and a malware delivery technique Microsoft tracks as RedFlick.

The technique is used to establish scheduled tasks that help deploy CosmicPulse, a malicious Python backdoor associated with Star Blizzard. Microsoft says the newer infection flow can require only a single user interaction, compared with earlier ClickFix-based chains that required victims to perform multiple actions.

Microsoft observed the activity targeting Ukrainian individuals and institutions, as well as international NGOs, think tanks, governments and financial organisations associated with support for Ukraine. The company says the activity affected more than 100 organisations, primarily in the United States and United Kingdom.

The research provides a detailed look at how Star Blizzard changed its initial access, persistence and malware-delivery techniques between January and August 2026.

Star Blizzard Changes Its Initial Access Strategy

Star Blizzard has previously been associated with targeted social engineering and spear-phishing operations.

According to Microsoft, campaigns observed during 2023 and 2024 commonly began with an email exchange designed to establish contact with a target. A subsequent message could contain a malicious link leading to infrastructure used for credential theft, with the actor sometimes impersonating known political or diplomatic figures.

During 2026, Microsoft observed the actor supplementing those operations with larger-scale phishing campaigns.

The campaigns ranged from tens to hundreds of messages, a scale Microsoft says it had not previously observed from the actor.

Microsoft identified at least 13 distinct large-scale phishing campaigns beginning in January 2026. The initial campaigns focused on unidentified Ukrainian users and used themes such as tax audits and outstanding fines. From March onward, the targeting expanded internationally.

Later campaigns frequently used invitations to conferences, private meetings and strategic discussions as social-engineering themes.

Targets included:

• Government officials

• Security researchers

• Academic organisations

• Media organisations

• NGOs

• Think tanks

• Financial organisations

• Diplomatic and multilateral organisations

• Technology-sector organisations

Microsoft also observed multiple people within the same organisation being targeted. Some messages were designed to look like internal communications originating from the target organisation.

From Targeted Phishing to Larger Campaigns

The change in scale is one of the most important developments highlighted by Microsoft.

Rather than relying exclusively on individually targeted spear-phishing, Star Blizzard began sending larger batches of initial-contact emails.

Microsoft says the campaigns likely involved a mass-mailing phishing platform that could automate campaign execution and expand the initial pool of potential victims. This is an assessment from Microsoft based on the observed campaign characteristics, rather than a technical specification of a confirmed platform.

The campaign themes varied.

In January, messages used Ukrainian-language themes relating to tax audit results. February campaigns used messages concerning payment of fines. From March, the actor increasingly used invitations to private roundtables, conferences and strategic discussions.

Examples documented by Microsoft included invitations referencing the IISS, CES, Atlantic Council, Chatham House and other conference or policy-related themes.

The social-engineering approach remained important even as the campaign scale increased.

Recipients who responded to the initial message would typically receive a second email containing a password-protected RAR or ZIP archive. The password was provided as an image inside the email.

This approach allowed the initial message to look relatively lightweight while moving the malicious attachment into a subsequent interaction.

Compromised Websites Become Part of the Delivery Infrastructure

Another significant change involved the accounts used to send phishing emails.

Microsoft says that, before the larger campaigns, Star Blizzard frequently used free email services, including ProtonMail and Microsoft consumer accounts, to impersonate people known to potential targets.

From March 2026, Microsoft observed the actor using accounts created on compromised websites.

The websites were hosted using platforms including cPanel and WordPress. Microsoft observed the same account name being used across multiple website domains and assesses with high confidence that the websites had been compromised for this purpose.

This matters because the infrastructure used for phishing can influence how recipients and automated security controls evaluate a message.

A compromised legitimate website can provide a different trust context from an obviously disposable email account.

For defenders, this means phishing investigations cannot focus exclusively on newly registered or suspicious-looking domains. Legitimate infrastructure can also become part of an attack chain after compromise.

RedFlick Changes the Malware Delivery Flow

The central technical development in Microsoft's report is RedFlick.

Microsoft describes RedFlick as a malware delivery technique involving scheduled tasks that help deploy CosmicPulse.

The technique represents a change from Star Blizzard's earlier ClickFix-based infection chains.

ClickFix-style campaigns required victims to perform several actions. The RedFlick flow reduces the amount of interaction required from the victim.

The result is a more streamlined delivery chain in which malicious execution and persistence are increasingly handled through Windows components and scheduled tasks rather than continued manual interaction by the victim.

The VHDX Delivery Chain

Microsoft observed a malicious VHDX-based delivery chain in mid-January 2026.

The attack began with a phishing email containing a password-protected ZIP archive.

Inside the archive was a VHDX file containing:

• A malicious LNK file disguised as a PDF

• A hidden directory

• A BAT script

• A legitimate decoy PDF

When the LNK was opened, conhost.exe was launched in a hidden window and subsequently spawned cmd.exe to execute the embedded BAT script.

The BAT script opened the decoy PDF while also invoking SSH.exe with PermitLocalCommand enabled. Microsoft observed this mechanism being used to download and execute a remotely hosted MSI installer.

The MSI installer then created a scheduled task that used control.exe to download and execute a remotely hosted CosmicPulse downloader masquerading as a Control Panel applet.

This represented an important change from earlier ClickFix campaigns because the execution chain relied more heavily on system utilities and scheduled execution.

CosmicPulse: The Backdoor Behind the Delivery Chain

The CosmicPulse downloader's purpose is to download and install the CosmicPulse backdoor.

Microsoft notes that CosmicPulse is also publicly known as NOROBOT or BAITSWITCH.

The downloader retrieves two ZIP files and stores them on the infected system. It also writes an encrypted AES key to the following registry location:

HKEY_CURRENT_USER\Software\Classes\.mollis

One ZIP contains a Python 3.8 64-bit package and a Python file that acts as the CosmicPulse bootstrapper.

The bootstrapper reads the encrypted key from the registry and uses an embedded key to recover it. It then uses the recovered key to decode the CosmicPulse payload, also referred to as YESROBOT.

Microsoft says the CosmicPulse backdoor underwent smaller changes during 2026 to circumvent existing signatures, but its capabilities and purpose remained consistent with previously documented versions.

Three Scheduled Tasks Strengthen Persistence

In April 2026, Microsoft observed another change in Star Blizzard's persistence mechanism.

An earlier January campaign involved an MSI installer creating a single scheduled task.

By April, Microsoft observed the installer creating three scheduled tasks designed to look like legitimate Windows network or system components.

The three tasks were:

1. Internet Quality Test Connection

2. Network Configuration Manager

3. System Health Monitor

Microsoft observed at least one incident in which either the first or third task deployed CosmicPulse.

Task 1: Internet Quality Test Connection

The first task was designed to appear legitimate while serving multiple purposes.

It sent a UTF-16 and Base64-encoded string containing the infected device's network or computer name and username to the command-and-control server.

The same task could also execute an attacker-controlled DLL remotely through Control_RunDLL from Shell32.dll.

Microsoft says the observed implementation used a WebDAV UNC path to access the remote payload, allowing the resource to be retrieved over HTTP rather than through a conventional SMB network share.

Task 2: Network Configuration Manager

The second task supported the WebDAV-based execution mechanism.

It caused Windows to treat a UNC-style path as a WebDAV resource and process it through the WebDAV redirector and WebClient functionality.

This allowed applications to interact with a remote web resource as though it were a file or folder path while the underlying communication used HTTP or HTTPS.

Task 3: System Health Monitor

The third scheduled task used control.exe to access a remote path hosted on a hardcoded command-and-control server and execute the next stage.

The use of names such as "System Health Monitor" and "Network Configuration Manager" illustrates the actor's attempt to make malicious scheduled tasks resemble ordinary system components.

Payloads Hidden Inside PDF Files

Star Blizzard changed its delivery approach again in July 2026.

Microsoft observed a multistage chain in which a password-protected RAR archive was nested inside a ZIP file.

Opening the archive exposed an LNK file.

The LNK used conhost.exe and curl to download a PDF from infrastructure controlled by the actor.

The PDF was not simply a document used as a decoy.

According to Microsoft, the downloaded PDF contained encoded data that the subsequent PowerShell activity searched for using a specific magic header.

The PowerShell code extracted 208 bytes of Base64-encoded data following the cAB header and executed the decoded command.

That command attempted to download and install another MSI file.

The Python installer then contained obfuscated PowerShell code that attempted to create additional scheduled tasks. One acted as a helper while another attempted to download and execute a CPL applet.

The technique demonstrates how an apparently harmless document can become one component in a multi-stage execution chain.

The security challenge is therefore not limited to detecting a malicious executable attachment. Defenders may need visibility into the behaviour of LNK files, command interpreters, scripting engines, network utilities and scheduled tasks.

The Broader Evolution of Star Blizzard's Malware Delivery

Microsoft identifies three major changes in the malware delivery techniques observed between January and August 2026:

• Moving away from earlier ClickFix-based delivery chains

• Introducing VHDX-based lures and expanding scheduled-task persistence

• Concealing payloads inside PDF files

The common theme is a reduction in reliance on repeated victim interaction.

The actor increasingly used legitimate Windows components and multi-stage execution to move from an initial attachment toward CosmicPulse.

Microsoft also observed steganography being used to conceal identifiers during a campaign in mid-August.

Taken together, the changes show an operational focus on adapting delivery methods as defenders become familiar with earlier techniques.

What Organisations Can Do to Reduce Risk

Microsoft's recommendations focus on phishing resistance, identity controls, endpoint protection, network controls and continuous monitoring.

The first layer is phishing resistance.

Microsoft recommends using phishing-resistant authentication methods and Conditional Access policies to strengthen account security.

Organisations should also use email security capabilities that inspect incoming messages and visited websites. Microsoft specifically recommends Safe Links and Safe Attachments for Microsoft 365 environments.

Watch for the Phishing Pattern

Microsoft highlights several characteristics that can help users recognise the activity.

Initial contact may arrive without an attachment.

If the recipient engages with the sender, a follow-up message may contain a password-protected RAR or ZIP archive.

The sender may use the name of a genuine person or organisation, while the actual registered domain does not match the organisation being impersonated.

Microsoft recommends verifying suspicious communications through a previously established and trusted contact method.

RedFlick campaign messages may also be sent in bulk, even when their content is designed to appear relevant to a particular organisation or professional community.

Endpoint and Identity Controls

Microsoft recommends several additional defensive controls, including:

• Running endpoint detection and response in block mode

• Enabling Microsoft Defender SmartScreen where appropriate

• Configuring automated investigation and remediation

• Enabling cloud-delivered protection and automatic sample submission

• Using security defaults and Conditional Access

• Implementing continuous access evaluation

• Enabling Microsoft Defender Antivirus real-time protection

• Monitoring suspicious authentication and network activity

• Enabling Zero-hour Auto Purge in Defender for Office 365

• Enabling network protection

• Rechecking links at click time through Safe Links

• Using Attack Simulator for controlled phishing awareness exercises

• Deploying relevant attack surface reduction rules

• Restricting unnecessary outbound SSH connections through firewall controls

These recommendations come directly from Microsoft's guidance for organisations concerned about Star Blizzard and RedFlick activity.

Microsoft Defender Detection Coverage

Microsoft also documented detection coverage associated with the observed activity.

For initial access, the company lists detections covering phishing emails, suspicious PDF phishing, malicious LNK execution from containers and suspicious downloads through curl.

For execution, Microsoft identifies detections associated with RedFlick, CosmicPulse, suspicious msiexec.exe behaviour and suspicious script execution.

For stealth, the documented coverage includes suspicious Control Panel item usage and suspicious process names.

Microsoft also provides threat intelligence and hunting resources through Microsoft Defender XDR and Microsoft Sentinel.

Hunting for Star Blizzard Activity

Microsoft published several Advanced Hunting examples that defenders can use as starting points.

One query looks for conhost.exe invoking curl, a combination observed in the July 2026 delivery chain.

Another looks for ssh.exe with:

PermitLocalCommand=yes

and:

LocalCommand=cmd.exe

This combination relates to the January 2026 VHDX delivery chain.

A separate query searches for the scheduled-task names associated with the April campaign:

• Internet Quality Test Connection

• Network Configuration Manager

• System Health Monitor

Microsoft cautions that these queries can produce activity unrelated to Star Blizzard or malicious behaviour, so findings require investigation and validation.

Indicators of Compromise

Microsoft's report also includes hashes, domains and IP addresses associated with observed RedFlick and CosmicPulse activity.

Examples include SHA-256 hashes associated with password-protected ZIP attachments and VHDX files, along with infrastructure used for RedFlick installers and CosmicPulse payloads.

The published indicators include domains such as:

• etia[.]ca

• groy[.]cc

• muvb[.]net

• matjk[.]click

• bpdaersa[.]click

• Itechx[.]tel

• guach[.]net

• byveo[.]org

• secure-dns-hub[.]com

• cyrna[.]top

• drasw[.]club

Microsoft also published associated IP indicators and file hashes in the report. Organisations should retrieve the current Microsoft source when operationally using these indicators because threat infrastructure can change.

Security Copilot and Threat Intelligence Workflows

Microsoft's report also points to Security Copilot capabilities for organisations using Microsoft's security ecosystem.

Microsoft says Security Copilot can assist with incident summaries, file and script analysis, identity analysis, guided responses, device summaries, hunting queries and incident reports.

The company also lists Security Copilot agents for:

• Threat intelligence briefings

• Phishing triage

• Threat hunting

• Dynamic threat detection

Microsoft Defender XDR customers can additionally access threat analytics covering Star Blizzard, CosmicPulse and related phishing activity.

These capabilities are presented by Microsoft as part of its defensive tooling rather than as a replacement for security monitoring and investigation.

What the RedFlick Evolution Means for Defenders

The Microsoft research highlights a broader shift in how established threat actors can adapt phishing operations.

The important change is not simply the appearance of a new malware name or a new attachment format.

Star Blizzard's 2026 activity combines changes across several layers:

At the campaign level, the actor moved toward larger-scale initial-contact phishing.

At the infrastructure level, Microsoft observed accounts created on compromised websites.

At the delivery level, campaigns incorporated VHDX files, LNK files, PDFs, PowerShell, MSI installers and Control Panel applets.

At the persistence level, scheduled tasks were increasingly used to maintain execution.

At the payload level, the campaigns continued deploying CosmicPulse.

At the detection-evasion level, Microsoft observed changes intended to make the activity less dependent on previously identifiable infection patterns.

For enterprises, this means phishing defence needs to extend beyond simply blocking suspicious domains or training users not to open attachments.

Security teams also need visibility into execution chains that combine legitimate operating-system utilities.

An apparently ordinary scheduled task, an LNK file that resembles a document, a PDF containing encoded data, or an unexpected use of curl, SSH, PowerShell or control.exe can become more meaningful when these events are correlated.

Key Takeaways

Microsoft's September 2026 research identifies several developments in Star Blizzard's activity:

1. Larger-scale phishing: Star Blizzard expanded beyond exclusively targeted spear-phishing into campaigns involving tens to hundreds of messages.

2. Broader targeting: Campaigns expanded from Ukraine-focused activity toward international governments, NGOs, think tanks, financial organisations and other targets.

3. Compromised websites: Microsoft observed accounts created on compromised cPanel and WordPress-hosted websites being used to send phishing messages.

4. RedFlick delivery: Scheduled tasks became a central component of the newer malware delivery technique tracked as RedFlick.

5. VHDX-based delivery: Malicious VHDX files were used to hide LNK files, scripts and decoy documents.

6. PDF payload concealment: Later campaigns concealed encoded payloads inside PDFs as part of a multi-stage execution chain.

7. CosmicPulse deployment: The delivery chains ultimately supported installation of the CosmicPulse backdoor.

8. Expanded persistence: Multiple scheduled tasks were used to support execution, WebDAV functionality and payload delivery.

9. Defensive monitoring: Microsoft recommends phishing-resistant authentication, Conditional Access, endpoint protection, email security, network controls and continuous monitoring.

10. Threat hunting: Microsoft provides hunting queries, detections and indicators to help organisations identify activity associated with the campaigns.

The research shows how Star Blizzard has continued adjusting its phishing and malware-delivery techniques during 2026. Rather than relying on one fixed infection mechanism, the actor has changed campaign scale, infrastructure, delivery formats and persistence methods.

For defenders, the practical lesson is that detection should focus on behaviour and attack-chain relationships as well as individual files, domains or email characteristics.