Microsoft says Star Blizzard is using a new delivery method called RedFlick to automate attacks and deploy its CosmicPulse backdoor with less victim interaction. The campaign uses phishing emails, malicious archives, and staged payloads to target organizations supporting Ukraine, as well as NGOs, think tanks, governments, and financial institutions. #StarBlizzard #RedFlick #CosmicPulse #NOROBOT #BAITSWITCH
Keypoints
- Star Blizzard is using RedFlick to deliver the CosmicPulse backdoor.
- The attack starts with phishing emails and password-protected archives.
- A disguised LNK file inside a VHDX image launches the infection chain.
- Scheduled tasks and BAITSWITCH help evade detection and fetch payloads.
- The campaign has hit more than 100 organizations across multiple sectors.