Microsoft Says Star Blizzard Phishing Targeted Over 100 Organizations With CosmicPulse Malware

Russian state-sponsored group Star Blizzard has used compromised legitimate websites and a malware-delivery technique Microsoft calls RedFlick in phishing campaigns that affected more than 100 organizations, primarily in the United States and United Kingdom, between January and August 2026. The campaigns targeted Ukrainian individuals and institutions, international nongovernmental organizations, think tanks, governments, financial institutions and other groups connected to support for Ukraine, delivering the CosmicPulse backdoor through staged scheduled-task activity, Microsoft said in a report published September 29, 2026.

Key Points

• Blizzard, attributed to Russia’s FSB Centre 18, expanded its phishing operations in 2026
• Microsoft observed more than 100 affected organizations, mainly in the United States and United Kingdom.
• The group shifted to new phishing tactics and automated scheduled tasks to maintain long-term access to victim networks.
• Microsoft recommends phishing-resistant multifactor authentication, Defender protections, endpoint detection, PowerShell logging and threat hunting for RedFlick-related task names and detections.

Star Blizzard’s Targets and Changing Attack Methods

Microsoft attributed Star Blizzard to the Russian Federal Security Service’s Centre 18. The group is also tracked as Callisto, COLDRIVER and SEABORGIUM. Microsoft observed multiple campaign waves from January through August 2026 and said the activity supported cyberespionage objectives, including credential theft and long-term access to mailboxes for intelligence collection.

Star Blizzard shifted from earlier ClickFix-style lures, which required victims to run commands supplied through fake CAPTCHA pages, to a delivery chain that generally requires one user interaction. The group also began sending lures from accounts on compromised legitimate websites, particularly cPanel and WordPress sites, instead of relying only on infrastructure controlled directly by the actor.

Initial emails often contained no attachment. When a recipient engaged, Star Blizzard followed up with a password-protected RAR or ZIP archive and supplied the password as an image. Microsoft observed messages impersonating think tanks, event organizers and government agencies, as well as localized themes involving tax audits and fines, water-supply shutdowns and payment advice.

Event-themed emails mentioned organizations such as the International Institute for Strategic Studies, the Atlantic Council, and Chatham House. Microsoft observed one Atlantic Council-themed campaign that led, in at least one instance, to DarkSword, an iOS backdoor, rather than the Windows delivery chain.

Microsoft described RedFlick as follows:

“RedFlick, a malware delivery technique that helps evade detection by initiating a set of scheduled tasks to deploy the actor’s custom backdoor, CosmicPulse.”

Microsoft

Security Arsenal said RedFlick is not a software vulnerability, has no CVE or patch, and represents in-the-wild nation-state tradecraft that requires operational and behavioral mitigations.

Monthly Attack Timeline

In January, Star Blizzard used tax-audit and fine-notice themes against Ukr.net users. The observed chain used a VHDX file containing an LNK file that ran scripts to retrieve an MSI installer. February campaigns continued using Ukraine-related themes.

March campaigns used invitations associated with the International Institute for Strategic Studies and the Atlantic Council. Microsoft observed RedFlick lures during that month, along with the Atlantic Council-themed DarkSword delivery. In April, MSI installers began creating scheduled tasks, and Microsoft observed a transition to RedFlick persistence through multiple tasks.

Event-themed mass campaigns continued from May through July. In July, one multistage chain used an LNK file, conhost.exe, curl and a PDF containing a hidden Base64 payload. PowerShell extracted and executed the payload, which then downloaded and installed an MSI package.

August campaigns continued sending phishing messages through compromised websites and used steganography to conceal identifiers. Microsoft said the broader change to larger-scale phishing and scheduled-task delivery increased the actor’s reach while reducing the amount of interaction required from victims.

Delivery and persistence chain

The archives observed by Microsoft contained LNK or VHDX files. In one variant, an LNK disguised as a PDF launched conhost.exe and cmd.exe to run embedded batch commands that downloaded an MSI installer. In another, a VHDX contained an LNK file, a hidden batch file and a decoy PDF; the LNK launched hidden conhost.exe and used SSH.exe or curl to retrieve the MSI.

The July variant used conhost.exe and curl to download a PDF. A PowerShell payload identified hidden Base64 data by its cAB header, decoded it and executed a command that downloaded and installed an MSI package. Microsoft also observed the use of PowerShell, mshta, wscript, cscript, rundll32.exe with url.dll, curl and SSH.exe across the delivery chains.

By April, the MSI installers were creating three scheduled tasks that masqueraded as legitimate system or network components. The task named Internet Quality Test Connection registered the victim with the command-and-control infrastructure by sending UTF-16 Base64-encoded host and user information. It could also invoke remote DLL execution through Control_RunDLL from Shell32.dll using a WebDAV UNC path.

The task named Network Configuration Manager configured WebDAV client support and WebClient functionality. The task named System Health Monitor used control.exe to access a remote path on the command-and-control infrastructure and execute the next stage, the CosmicPulse downloader.

The WebDAV UNC paths allowed Windows to retrieve remote payloads over HTTP or HTTPS rather than SMB. The technique also enabled remote DLL execution through Control_RunDLL. Microsoft said the chain included staged execution and avoided some early disk writes, while payload delivery was gated on validation of the victim.

The downloader masqueraded as a Control Panel applet and is publicly known as NOROBOT or BAITSWITCH. It installed CosmicPulse, a Python-based backdoor also tracked as YESROBOT. The CosmicPulse bootstrapper used embedded keys to recover and decode the payload and read an encrypted AES key stored in the registry; Microsoft identified the registry location as HKEY_CURRENT_USER\Software\Classes\.mollis.

Detection and mitigation

Microsoft’s relevant detections include Trojan:Script/RedFlick and Backdoor:Python/CosmicPulse. Defenders can also hunt for scheduled tasks named Internet Quality Test Connection, Network Configuration Manager and System Health Monitor, along with the domain secure-dns-hub[.]com and IP address 103.160.59[.]97.

Microsoft recommends phishing-resistant multifactor authentication using FIDO2, passkeys or certificate-based authentication, together with Conditional Access policies and the blocking of legacy authentication. It also recommends enabling Safe Links with time-of-click URL checks, Safe Attachments and Zero-hour Auto Purge in Defender for Office 365, as well as advanced anti-phishing protections.

For endpoints, Microsoft recommends running endpoint detection and response in block mode, enabling Attack Surface Reduction rules that block Office applications from spawning scripts and block obfuscated scripts, and enabling cloud-delivered protection and automatic sample submission. Organizations should enable PowerShell logging and baseline or alert on mshta, wscript and rundll32.exe making external HTTPS connections.

Incident responders should search for the three scheduled tasks and the two Microsoft detection names, collect browser history and mail artifacts, review PowerShell Script Block logs and conduct retrospective hunting across at least 14 days. For iOS devices, Trellix advised updating iPhones to iOS 26.3 or later to address flaws exploited by DarkSword and using Lockdown Mode where updates are not possible.