Microsoft Threat Intelligence says Star Blizzard is using a delivery technique it calls RedFlick to install CosmicPulse, a custom backdoor. The reported campaigns use changing phishing lures and file chains; in the newer flow, Microsoft says a victim needs to take one action to start execution, rather than the multiple actions required by earlier ClickFix-based chains. Microsoft reports activity affecting more than 100 organizations, primarily in the United States and United Kingdom.
What RedFlick does
RedFlick is Microsoft’s name for a malware-delivery technique used by Star Blizzard. It is not the name of the backdoor itself: the technique is used to deliver CosmicPulse, a custom Python backdoor that Microsoft says is also known publicly as NOROBOT or BAITSWITCH. The backdoor payload is also known as YESROBOT.
As an Amazon Associate I earn from qualifying purchases.
The method varies between campaigns, but the reported chains use phishing messages and files to get a victim’s device to retrieve and run an installer or another payload. Some versions establish persistence with scheduled tasks and use Windows components such as control.exe to run a remote Control Panel applet (CPL) downloader. Microsoft says the newer approach reduces the number of actions required from the target compared with earlier ClickFix chains; it does not mean the activity succeeds without a user interaction.
Who Microsoft says is behind it and who is targeted
Microsoft attributes the activity to Star Blizzard and says CISA attributes the group as subordinate to Russia’s Federal Security Service Centre 18 (FSB Centre 18). The reported targets include Ukrainian individuals and institutions, as well as international NGOs, Western think tanks, governments, and financial institutions associated with support for Ukraine.
#1 Best Overall
![Norton 360 Deluxe 2027 Antivirus, 3 Devices, Auto-Renews [Download]](https://m.media-amazon.com/images/I/41qw3FS3qLL._SL160_.jpg)
- ONGOING PROTECTION Download instantly & install protection for 3 PCs, Macs, iOS or Android devices in minutes!
- TOP-PERFORMING VPN Faster speeds, more server locations, and greater connection control to protect your privacy across all your devices, including Smart TVs.
- ADVANCED SCAM PROTECTION Help spot hidden scams online. With the built-in Genie AI assistant, you’ll never wonder if a message or email is suspicious again.
- REAL-TIME PROTECTION Advanced security protects against existing and emerging malware threats, including ransomware and viruses, and it won’t slow down your device performance.
- DARK WEB MONITORING Identity thieves can buy or sell your information on websites and forums. We search the dark web and notify you should your information be found.
Microsoft says it observed a shift in 2026 from exclusively targeted spear-phishing toward larger-scale initial-contact phishing. Lures included conferences or other events, and some messages were made to resemble internal communications. Some emails came from accounts created on compromised CPanel- and WordPress-hosted websites.
Microsoft Threat Intelligence reported at least 13 distinct large-scale phishing campaigns since January 2026. It said the activity affected over 100 organizations, primarily in the United States and United Kingdom, with each campaign sending tens to hundreds of email messages. These are Microsoft’s reported observations, not a complete count of victims or an independently verified census.
Rank #2
- THREAT DETECTION – Stay one step ahead. Suspicious links, risky sites, viruses, and scams, caught automatically before they reach you.
- PERSONAL INFO PROTECTION – Keep your personal info safer. Identity monitoring watches for your exposed info and tells you what to do about it.
- SECURE CONNECTIONS – Just a few easy clicks, and we'll automatically protect your info on public Wi‑Fi, every time you connect.
- GUIDED ACTION – Know what matters and what to do next. Clear alerts and simple guidance make it easy to take action.
- MORE THAN ANTIVIRUS – Scam protection, identity monitoring, VPN, web protection, and antivirus work together to protect you, all in one place.
How the delivery changed across campaigns
Microsoft describes multiple campaign waves, not one fixed sequence. The file formats and execution methods changed over time:
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
| Campaign period | Reported lure or file chain | Execution and persistence |
|---|---|---|
| January 2026 | A password-protected ZIP contained a VHDX disk image. Inside it was an LNK disguised as a PDF, a hidden directory with a BAT script, and a legitimate decoy PDF. | Opening the LNK launched a hidden command chain. The BAT script opened the decoy and invoked SSH to retrieve and run a remote MSI. |
| April 2026 | MSI installers were used in multiple campaigns. | The installers created three scheduled tasks disguised as network components: “Internet Quality Test Connection,” “Network Configuration Manager,” and “System Health Monitor.” Microsoft reported that the first sent host and user information to command-and-control infrastructure and enabled remote DLL execution through WebDAV; the second supported WebDAV access; and the third ran the next stage through control.exe. |
| July 2026 | An LNK downloaded a PDF containing an encoded PowerShell payload. | PowerShell extracted and executed a Base64-encoded command from the PDF, which then downloaded an MSI. |
Across multiple campaigns, Microsoft observed an MSI installing a scheduled task that used control.exe to run a remote CPL downloader, which installed CosmicPulse. The exact chain should not be assumed to be identical in every RedFlick campaign: Microsoft’s examples show the delivery approach evolving, including concealed payloads and scheduled tasks.
Rank #3
![Norton 360 Deluxe 2027 Antivirus, 5 Devices, Auto-Renews [Download]](https://m.media-amazon.com/images/I/41IYV5zGyCL._SL160_.jpg)
- ONGOING PROTECTION Download instantly & install protection for 5 PCs, Macs, iOS or Android devices in minutes!
- TOP-PERFORMING VPN Faster speeds, more server locations, and greater connection control to protect your privacy across all your devices, including Smart TVs.
- ADVANCED SCAM PROTECTION Help spot hidden scams online. With the built-in Genie AI assistant, you’ll never wonder if a message or email is suspicious again.
- REAL-TIME PROTECTION Advanced security protects against existing and emerging malware threats, including ransomware and viruses, and it won’t slow down your device performance.
- DARK WEB MONITORING Identity thieves can buy or sell your information on websites and forums. We search the dark web and notify you should your information be found.
How organizations can reduce the risk
Microsoft’s recommendations focus on reducing the chance that a phishing message leads to account or device compromise, and on detecting activity that gets through. Organizations with government, NGO, or think-tank work adjacent to Ukraine policy or support are among those Microsoft highlights as especially likely to be at risk.
- Make account takeover harder. Use phishing-resistant authentication and Conditional Access policies.
- Block malicious messages and links. Scan email and visited websites, enable Safe Links and Safe Attachments, and use Zero-hour auto purge to remove malicious messages when detected.
- Strengthen endpoint protection. Use endpoint detection and response in block mode, real-time antivirus, cloud-delivered protection, SmartScreen, automated investigation and remediation, and network protection.
- Investigate unusual sign-ins and device activity. Monitor continuously for anomalous sign-ins and investigate suspicious activity rather than relying only on a single alert or indicator.
Hunting for RedFlick-related activity
Microsoft’s report includes Microsoft Defender XDR hunting queries and indicators of compromise (IOCs). The query patterns it identifies include conhost.exe invoking curl, SSH launched with PermitLocalCommand=yes and LocalCommand=cmd.exe, and the three scheduled-task names listed above. Use the report’s queries in the appropriate Defender XDR environment rather than treating these patterns as a standalone verdict.
Rank #4
- SPEED-OPTIMIZED, CROSS-PLATFORM PROTECTION: World-class antivirus security and cyber protection for Windows (Windows 7 with Service Pack 1, Windows 8, Windows 8.1, Windows 10, and Windows 11), Mac OS (Yosemite 10.10 or later), iOS (11.2 or later), and Android (5.0 or later). Organize and keep your digital life safe from hackers
- SAFE ONLINE BANKING: A unique, dedicated browser secures your online transactions; Our Total Security product also includes 200MB per day of our new and improved Bitdefender VPN
- ADVANCED THREAT DEFENSE: Real-Time Data Protection, Multi-Layer Malware and Ransomware Protection, Social Network Protection, Game/Movie/Work Modes, Microphone Monitor, Webcam Protection, Anti-Tracker, Phishing, Fraud, and Spam Protection, File Shredder, Parental Controls, and more
- ECO-FRIENDLY PACKAGING: Your product-specific code is printed on a card and shipped inside a protective cardboard sleeve. Simply open packaging and scratch off security ink on the card to reveal your activation code. No more bulky box or hard-to-recycle discs. PLEASE NOTE: Product packaging may vary from the images shown, however the product is the same.
Microsoft cautions that some query results can be unrelated or legitimate, so analysts should validate results in context and investigate associated process, account, and network activity. The report also lists SHA-256 hashes, domains, and IP addresses tied to observed campaign files and infrastructure. Because indicators can become stale and may be shared or reused, correlate an indicator match with behavior; a match alone does not prove a system is compromised.
Microsoft Threat Intelligence’s full report, including its hunting queries and IOCs, is available at “Star Blizzard refines phishing and malware delivery with the RedFlick technique”, published September 29, 2026.
Quick Recap
Best Value
- THREAT DETECTION – Stay one step ahead. Suspicious links, risky sites, viruses, and scams, caught automatically before they reach you.
- PERSONAL INFO PROTECTION – Keep your personal info safer. Identity monitoring watches for your exposed info and tells you what to do about it.
- SECURE CONNECTIONS – Just a few easy clicks, and we'll automatically protect your info on public Wi‑Fi, every time you connect.
- GUIDED ACTION – Know what matters and what to do next. Clear alerts and simple guidance make it easy to take action.
- MORE THAN ANTIVIRUS – Scam protection, identity monitoring, VPN, web protection, and antivirus work together to protect you, all in one place.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
