[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fFTeqILWfk0oS10swzr9Rhl_9ntL6jx44NMh3Y-BjcOQ":3,"$fpnTGAik5bCBHx4wmxzZw2nEIDgonyZmLJiUICcveedw":62},{"article":4},{"slug":5,"title":6,"subtitle":7,"summary":8,"tags":9,"body_md":16,"hero_image_url":17,"structured":18,"story_type":58,"created_at":59,"updated_at":60,"published_at":61},"star-blizzard-apt-swaps-clickfix-for-redflick-to-drop-cosmicpulse-on-ukrainian-t","Star Blizzard swaps ClickFix for RedFlick to deliver its CosmicPulse backdoor","Microsoft says the Russian state actor ran at least 13 large-scale phishing campaigns between January and August 2026, affecting more than 100 organisations, mainly in the US and UK.","Microsoft reports that Star Blizzard, a Russian state actor that CISA attributes to FSB Centre 18, has replaced its multi-step ClickFix chains with RedFlick, a delivery technique that needs a single user interaction and uses scheduled tasks to deploy the CosmicPulse backdoor. At least 13 campaigns since January 2026 affected more than 100 organisations, primarily in the United States and United Kingdom.",[10,11,12,13,14,15],"Star Blizzard","RedFlick","CosmicPulse","ClickFix","Ukraine","FSB","# Star Blizzard swaps ClickFix for RedFlick to deliver its CosmicPulse backdoor\n\n*Microsoft says the Russian state actor ran at least 13 large-scale phishing campaigns between January and August 2026, affecting more than 100 organisations, mainly in the US and UK.*\n\n**Tags:** `Star Blizzard` `RedFlick` `CosmicPulse` `ClickFix` `Ukraine` `FSB`\n\n> Microsoft reports that Star Blizzard, a Russian state actor that CISA attributes to FSB Centre 18, has replaced its multi-step ClickFix chains with RedFlick, a delivery technique that needs a single user interaction and uses scheduled tasks to deploy the CosmicPulse backdoor. At least 13 campaigns since January 2026 affected more than 100 organisations, primarily in the United States and United Kingdom.\n\n---\n\n## RedFlick replaces ClickFix\n\nMicrosoft Threat Intelligence published research on 29 September 2026 describing RedFlick, which it tracks as a new malware delivery technique used by Star Blizzard. RedFlick starts a set of scheduled tasks that deploy the group's custom backdoor, CosmicPulse. Unlike the earlier ClickFix chains, which needed the victim to carry out several manual steps, the RedFlick infection flow needs only a single user interaction.\n\nMicrosoft observed at least 13 large-scale phishing campaigns using the technique between January and August 2026. They affected more than 100 organisations, primarily in the United States and the United Kingdom.\n\n## How the chain works\n\nIn the January campaigns, a password-protected ZIP held a VHDX virtual disk containing an LNK file disguised as a PDF, a hidden folder with a batch script, and a decoy PDF. Opening the LNK ran the batch script, which used SSH.exe to download and run a remote MSI installer. The MSI created a scheduled task that used control.exe to run a downloader disguised as a Control Panel applet (CPL).\n\nMicrosoft says this downloader is publicly known as NOROBOT or BAITSWITCH, names from Google Threat Intelligence Group's October 2025 reporting. It fetches two archives, stores an encrypted AES key in the registry and uses an embedded Python bootstrapper to decrypt and run CosmicPulse, which is also known as YESROBOT.\n\nLater campaigns varied the chain. From April the MSI created three scheduled tasks, one of which sends host and user information to the command-and-control server and can run a remote DLL over WebDAV. In July the LNK used curl to download a PDF from which PowerShell extracted and ran a hidden Base64 payload, leading to another MSI and further scheduled tasks.\n\n## Targets\n\nAccording to Microsoft, the targets include Ukrainian individuals and institutions, international NGOs, Western think tanks, governments, financial institutions, technology-sector organisations and diplomatic staff. The organisations affected were primarily in the US and UK.\n\nThe earliest campaigns, in January and February, targeted users of the Ukrainian email provider Ukr.net with lures impersonating Ukrainian authorities, such as tax audit and fine notifications. From March the lures moved to invitations and events, including messages themed around the IISS, the Atlantic Council and Chatham House, and later a payment advice note in August.\n\nEarlier Star Blizzard operations impersonated political, diplomatic or academic figures using free email accounts. In 2026 Microsoft also saw the group send from accounts on compromised cPanel and WordPress sites, and some emails were made to look like internal communications from the targeted organisation.\n\n## Steganography and DarkSword\n\nMicrosoft says a campaign observed in mid-August 2026 used steganography to conceal identifiers. It gave no further detail.\n\nThe March campaign themed as an Atlantic Council closed-door discussion sent recipients a link to install the DarkSword iOS backdoor. Microsoft also cites a Proofpoint report from March on DarkSword targeting vulnerable Apple iOS devices.\n\n## About Star Blizzard\n\nStar Blizzard, which Microsoft also tracks as SEABORGIUM, is a Russian state actor that conducts cyberespionage. CISA attributes it as subordinate to the Russian Federal Security Service (FSB) Centre 18. BleepingComputer describes the group as active since 2017.\n\n## Key points\n\n- RedFlick replaces Star Blizzard's ClickFix chains with a flow that needs one user interaction and uses scheduled tasks to install CosmicPulse (also known as YESROBOT).\n- The downloader in the chain is the one publicly known as NOROBOT or BAITSWITCH.\n- Microsoft observed at least 13 large-scale campaigns from January to August 2026, affecting more than 100 organisations, primarily in the US and UK.\n- The first campaigns targeted Ukr.net users with lures impersonating Ukrainian authorities; later ones used event and invitation themes.\n- A mid-August campaign used steganography to conceal identifiers, and a March campaign pushed the DarkSword iOS backdoor.\n\n## Further reading & sources\n\n- [Star Blizzard refines phishing and malware delivery with the RedFlick technique | Microsoft Security Blog](https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fblog\u002F2026\u002F09\u002F29\u002Fstar-blizzard-refines-phishing-and-malware-delivery-with-the-redflick-technique)\n- [Russian state hackers use new RedFlick technique to push malware](https:\u002F\u002Fwww.bleepingcomputer.com\u002Fnews\u002Fsecurity\u002Frussian-state-hackers-use-new-redflick-technique-to-push-malware\u002F)\n- [Russia's Star Blizzard Ditches ClickFix to Widen Phishing Net](https:\u002F\u002Fwww.darkreading.com\u002Fthreat-intelligence\u002Frussia-star-blizzard-apt-ditches-clickfix-widen-phishing-net)\n- [Russian state actor Star Blizzard changes tactics with RedFlick malware chain](https:\u002F\u002Fwww.computing.co.uk\u002Fnews\u002F2026\u002Fsecurity\u002Frussian-state-actor-star-blizzard-changes-tactics)","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Fstar-blizzard-apt-swaps-clickfix-for-redflick-to-drop-cosmicpulse-on-ukrainian-t.png?v=5367408196",{"actors":19,"malware":26,"targets":34,"timeline":39,"technologies":51},[20],{"url":21,"name":10,"slug":22,"type":23,"origin":24,"motivation":25},"\u002Fthreat-groups\u002Fstar-blizzard","star-blizzard","apt","Russia (FSB Centre 18)","espionage",[27,29,30,32],{"name":28},"DarkSword",{"name":12},{"name":31},"NOROBOT",{"name":33},"BAITSWITCH",[35],{"name":36,"sector":37,"status":38,"geography":14},"Ukr.net","email provider","targeted",[40,44,47],{"date":41,"event":42,"description":43},"2025-10","Report","Google report on CosmicPulse backdoor",{"date":41,"event":45,"description":46},"Disclosure","Google's Threat Intelligence Group covered Star Blizzard's ColdCopy malware",{"date":48,"event":49,"description":50},"2026-01","Tactic change","RedFlick tactic introduced",[52,55],{"vendor":53,"product":54},"Microsoft","Windows",{"vendor":56,"product":57},"Apple","iOS","threat_actor_activity","2026-10-18T12:09:44.53734+00:00","2026-10-18T12:14:39.290143+00:00",null,{"articles":63},[64,77,90,103],{"slug":65,"title":66,"summary":67,"tags":68,"hero_image_url":75,"story_type":58,"created_at":76},"kaspersky-unveils-armored-likho-apt-using-busysnake-stealer-against-russian-braz","Kaspersky Unveils Armored Likho APT Using BusySnake Stealer Against Russian, Brazilian, and Kazakh Government and Critical Infrastructure","Kaspersky has described a previously unknown APT group, Armored Likho, running a spear-phishing campaign that drops a previously undocumented Python infostealer called BusySnake Stealer against government agencies and the electric power sector in Russia, Brazil and Kazakhstan.",[69,70,71,72,73,74],"Armored Likho","BusySnake Stealer","Kaspersky","APT","spear-phishing","critical infrastructure","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Fkaspersky-unveils-armored-likho-apt-using-busysnake-stealer-against-russian-braz.png?v=1bc6e1f6d4","2026-09-19T12:06:09.947355+00:00",{"slug":78,"title":79,"summary":80,"tags":81,"hero_image_url":88,"story_type":58,"created_at":89},"ahnlab-asec-links-gunra-ransomware-to-state-sponsored-actor-in-operation-double-","AhnLab ASEC Links Gunra Ransomware to State-Sponsored Actor in 'Operation Double Barrel'","AhnLab ASEC, with Korea's National Intelligence Service, National Police Agency, KISA and the Financial Security Institute, published 'Operation Double Barrel' on 30 July 2026, describing a state-sponsored actor that has exploited Korean financial security software since 2025 and the overlaps it shares with Gunra ransomware intrusions.",[82,83,84,85,86,87],"Gunra","AhnLab ASEC","Operation Double Barrel","FortiOS","FortiProxy","Ransomware","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Fahnlab-asec-links-gunra-ransomware-to-state-sponsored-actor-in-operation-double-.png?v=579bc98ad5","2026-09-18T07:15:06.272711+00:00",{"slug":91,"title":92,"summary":93,"tags":94,"hero_image_url":101,"story_type":58,"created_at":102},"shinyhunters-bypasses-mfa-with-salesforce-oauth-playbook","Cato CTRL Profiles ShinyHunters: Help-Desk Vishing and Trusted OAuth Apps Sidestep MFA","Cato CTRL's threat actor profile of ShinyHunters, published on 18 June 2026, describes how the UNC6040 campaign talked employees into approving a malicious Salesforce connected app and how the related UNC6395 cluster used stolen Salesloft Drift OAuth tokens, gaining access without compromising passwords or MFA.",[95,96,97,98,99,100],"ShinyHunters","Salesforce","MFA bypass","OAuth","Cato Networks","UNC6040","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Fshinyhunters-bypasses-mfa-with-salesforce-oauth-playbook.png?v=cacb0fd7ee","2026-09-05T07:16:15.004025+00:00",{"slug":104,"title":105,"summary":106,"tags":107,"hero_image_url":113,"story_type":58,"created_at":114},"muddywater-disguises-espionage-campaign-as-chaos-ransomware","MuddyWater disguised espionage intrusion as Chaos ransomware, Rapid7 reported in May","In May 2026 Rapid7 reported an intrusion that carried Chaos ransomware branding but, in its assessment, was an espionage operation by the Iranian state-linked group MuddyWater. The attackers gained access through Microsoft Teams social engineering, stole credentials, deployed a custom backdoor and exfiltrated data, and Rapid7 found no file encryption despite the Chaos artefacts.",[108,109,110,111,112],"MuddyWater","Chaos Ransomware","Rapid7","Microsoft Teams","Iran","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Fmuddywater-disguises-espionage-campaign-as-chaos-ransomware.png?v=db93f0d1eb","2026-09-02T07:19:02.642087+00:00"]