Star Blizzard refines phishing and malware delivery with the RedFlick technique | Microsoft Security Blog

Immediate Actions

Key Takeaways

• RedFlick uses three scheduled tasks masquerading as network components for persistence and C2.
• CosmicPulse is a Python-based backdoor downloaded as a CPL applet DLL.
• Actor shifted from spear phishing to mass phishing with tens to hundreds of emails per campaign.
• WebDAV UNC paths used to retrieve payloads over HTTP instead of SMB.
• Campaigns targeted over 100 organizations since January 2026.

Attack Chain

1. Initial Access: Phishing email delivers password-protected RAR or ZIP archive containing VHDX or LNK file
2. Execution: LNK file launches conhost.exe and cmd.exe to execute BAT script or SSH LOLBin
3. Download: SSH or curl downloads MSI installer from attacker-controlled domain
4. Persistence: MSI installer creates three scheduled tasks masquerading as network components
5. C2: Scheduled tasks use WebDAV UNC paths to download and execute CosmicPulse CPL applet
6. Exfiltration: CosmicPulse Python backdoor communicates with C2 server for command execution

Affected Systems

• Windows systems targeted by VHDX and LNK payloads
• Python 3.8 runtime environments on Windows
• Microsoft Office 365 email users
• Apple iOS devices targeted by DarkSword backdoor

Detection Availability

• Published: KQL, Other detection logic
• Platforms: Microsoft Defender XDR, Microsoft Sentinel

KQL hunting queries for conhost+curl, SSH LOLBin, and scheduled task names. ASIM queries for IP/domain IOCs.

Detection Engineering Assessment

Hypotheses are starting points derived from the article, not findings about your environment; validate against your own telemetry.

Hunting Hypotheses

Required Log Sources

• DeviceProcessEvents
• DeviceRegistryEvents
• DeviceEvents
• ASIM NetworkSession logs
• ASIM WebSession logs

Key Behavioral Indicators

• conhost.exe spawning curl for file downloads
• ssh.exe with PermitLocalCommand=yes parameter
• rundll32.exe with Control_RunDLL and DavWWWRoot UNC path
• control.exe accessing UNC paths with DavWWWRoot
• Scheduled tasks named Internet Quality Test Connection or System Health Monitor
• pythonw.exe executing from %appdata%\Python38-64 directory

Control Gaps

• Outbound SSH connections to non-business IPs may not be blocked
• WebDAV traffic over HTTP may not be inspected by network security tools
• PDF steganography may bypass email attachment scanning
• Scheduled task creation by MSI installers may not be alerted on

False Positive Assessment

Recommendations

Suggestions to evaluate against your own environment, tooling, and incident-response procedures — not directives.

Infrastructure Hardening

• Block outbound SSH connections to non-essential external networks
• Restrict WebDAV traffic and inspect HTTP traffic for UNC path access
• Enable phishing-resistant authentication and Conditional Access policies
• Configure email security to block password-protected archives from external senders

User Protection

• Enable Microsoft Defender SmartScreen on all endpoints
• Run EDR in block mode to catch post-compromise artifacts
• Turn on Safe Links and Safe Attachments for email
• Use Microsoft Edge with Defender SmartScreen protection

Security Awareness

• Train users to verify unexpected emails with attachments through trusted channels
• Warn users about conference invitation lures from unknown senders
• Instruct users to report emails with password-protected archives from external senders

MITRE ATT&CK Mapping

Plain-Language Summary

Russian hackers are sending fake conference invitations and government notices to trick people into opening malicious files. The files install hidden software that lets the hackers spy on computers. Organizations that support Ukraine are the main targets. People should be suspicious of unexpected emails with attachments and verify senders through other means.

Additional IOCs

• Ips:
  • 103[.]160[.]59[.]97 - Host for CosmicPulse downloader DLL in July campaign
• Domains:
  • muvb[.]net - Host for RedFlick MSI installer in February campaign
  • divekickspolic[.]org - Host for CosmicPulse backdoor download
  • matjk[.]click - Host for RedFlick MSI installer in March campaign
  • bpdaersa[.]click - Host for RedFlick MSI installer in March campaign
  • Itechx[.]tel - Host for RedFlick MSI installer in April campaign
  • guach[.]net - Host for RedFlick PowerShell code installer in June campaign
  • ruten[.]observer - Host for CosmicPulse downloader DLL in June-July campaigns
  • byveo[.]org - Host for RedFlick PowerShell code installer in July campaign
  • secure-dns-hub[.]com - Host for CosmicPulse downloader DLL in July-current campaigns
  • qumel[.]link - Host for CosmicPulse downloader DLL in July campaign
  • cyrna[.]top - Host for RedFlick MSI installer in August campaign
  • drasw[.]club - Host for CosmicPulse downloader DLL in August campaign
• Urls:
  • hxxps://etia[.]ca/f.msi - MSI installer download URL from January campaign
  • stuseamandesilt.org/updaters/p1.zip - CosmicPulse Python package download URL
  • stuseamandesilt.org/updaters/p3.zip - CosmicPulse payload download URL
• File Hashes:
  • 699e92a9e0edf7835879d5697bc67138c0b137117f459caf1a44df357407cad9 (SHA256) - Password-protected RAR attachment from June campaign
  • 24b6e36a09eb2acfc2a95478ca685acb7593b1689be6a4a639fe0d222393cfa7 (SHA256) - Password-protected RAR attachment from July campaign
  • dd98dbc1a55afe6fd0ed2ed53a79c76f6bde15081a0060422185b74eb1799ee4 (SHA256) - Password-protected ZIP attachment from August campaign
• Registry Keys:
  • HKEY_CURRENT_USER\Software\Classes\.mollis - AES key storage for CosmicPulse decryption
• File Paths:
  • %appdata%\Python38-64\Lib\libhealthupdate.py - CosmicPulse bootstrapper Python script
  • %appdata%\Python38-64\pythonw.exe - Python executable used to run CosmicPulse
• Command Lines:
  • Purpose: Download and execute remote MSI installer via SSH LOLBin | Tools: ssh.exe, msiexec.exe | Stage: Execution
  • Purpose: Download PDF and extract embedded payload | Tools: conhost.exe, curl, powershell.exe | Stage: Execution | conhost.exe --headless cmd /c curl
  • Purpose: Execute remote DLL via WebDAV UNC path | Tools: rundll32.exe, Shell32.dll | Stage: Execution | rundll32.exe Shell32.dll,Control_RunDLL \\
  • Purpose: Trigger WebClient service for WebDAV access | Tools: conhost.exe, net.exe | Stage: Execution | net.exe use \\DavWWWRoot
  • Purpose: Execute remote CPL applet via control.exe | Tools: control.exe | Stage: Execution | control.exe \\