Star Blizzard refines phishing and malware delivery with the RedFlick technique

What it is

Microsoft's 2026 update on Star Blizzard (FSB Centre 18) tracks a specific technique, "RedFlick," which abuses scheduled tasks to deploy the CosmicPulse backdoor (aka NOROBOT/BAITSWITCH downloader + YESROBOT payload), and documents the related delivery-chain overhaul observed January–August 2026.

How it works

Three delivery variants, in chronological order:

• Jan 2026 — VHDX chain: password-protected ZIP → malicious VHDX containing an LNK disguised as a PDF. Opening it spawns conhost.exe → cmd.exe running a BAT script that opens a decoy PDF and invokes ssh.exe with PermitLocalCommand=yes to download/run a remote MSI. The MSI creates a scheduled task that uses control.exe to fetch a CosmicPulse downloader compiled as a Control Panel applet (CPL) DLL.
• Apr 2026 — RedFlick scheduled-task persistence: MSI installer now creates three scheduled tasks masquerading as legitimate names: "Internet Quality Test Connection" (exfiltrates hostname/username via Base64, can remotely invoke Control_RunDLL via a WebDAV UNC path), "Network Configuration Manager" (preps WebDAV client for the others), and "System Health Monitor" (uses control.exe to execute the next-stage payload from C2). Either task 1 or 3 can deploy CosmicPulse.
• Jul 2026 — PDF-embedded payload: nested RAR-in-ZIP → LNK → conhost.exe+curl downloads a PDF from actor infrastructure → a PowerShell stage searches the PDF for magic header cAB, extracts 208 bytes of Base64 data, decodes and runs it, which downloads another MSI that creates two more scheduled tasks (a helper task + a CPL-downloading task).

CosmicPulse itself: downloads two ZIPs, writes an AES key to HKCU\Software\Classes\.mollis, uses one ZIP's Python 3.8 bootstrapper to recover the key (AES-ECB) and decode the second ZIP into the final Python backdoor (YESROBOT).

Separately, a March 2026 "Atlantic Council" lure delivered the DarkSword iOS backdoor instead of RedFlick (reported by ProofPoint), and an August 2026 campaign used steganography to conceal identifiers.

Preconditions / Affected

Requires a single user interaction (opening an attachment/link) vs. the prior multi-step ClickFix flow. Targets since Jan 2026: Ukrainian individuals/institutions, then from March onward NGOs, think tanks, governments, and financial institutions supporting Ukraine — 100+ organizations, mostly in the US and UK. Phishing now sent at scale (tens to hundreds of emails per campaign, 13+ distinct large-scale campaigns since January) from accounts created on compromised WordPress/CPanel sites rather than free-mail impersonation accounts.

What to do

Hunting queries (Defender XDR, 7-day lookback) given in the article:

• Detect conhost.exe launching curl (PDF download stage):

DeviceProcessEvents
| where Timestamp > ago(7d)
| where FileName == "conhost.exe"
| where ProcessCommandLine has "curl"

• Detect SSH-to-local-command abuse (Jan 2026 chain):

DeviceProcessEvents
| where Timestamp > ago(7d)
| where ProcessCommandLine has "ssh.exe"
| where ProcessCommandLine has "PermitLocalCommand=yes"
| where ProcessCommandLine has "LocalCommand=cmd.exe"

• Detect the masquerading scheduled tasks ("Internet Quality Test Connection", "Network Configuration Manager", "System Health Monitor") across DeviceProcessEvents/DeviceEvents/DeviceRegistryEvents (full union query in the post).
• Sentinel: ASIM-based queries matching a supplied IOC list (6 IPs including 103.245.231.248, 2.57.241.246; 16 domains including etia.ca, gliderrompercycl.com, secure-dns-hub.com) against network/web session tables, plus the built-in "TI map" analytics for automatic IOC matching.
• Firewall guidance: restrict outbound SSH to external/public networks not required for business, since the Jan chain relies on an outbound SSH call.

Caveats

Microsoft states it was unable to obtain a sample of the DLL payload invoked via Control_RunDLL in Task 1. The hunting queries are explicitly noted as potentially matching legitimate, non-malicious activity and require manual investigation.