CosmicPulse (Malware): news timeline & CVEs

Russian Hackers Target 100+ Organizations With New RedFlick Phishing Attack

Star Blizzard used RedFlick phishing against 100-plus organizations and later deployed the CosmicPulse backdoor.

Field Effect says Star Blizzard, also known as ColdRiver and Callisto, ran at least 13 phishing campaigns from January through August 2026 against more than 100 organizations, chiefly in the United States and United Kingdom. Targets included government, diplomacy, research, policy, journalism, and finance groups involved in Ukraine-related work. Initial emails have no attachments; replies are followed by password-protected RAR or ZIP archives that may contain a VHDX disk or an LNK file disguised as a PDF. From April, RedFlick installers created scheduled tasks, enabled WebDAV, and deployed the CosmicPulse backdoor, a sequence Microsoft observed in at least one incident.

Cyber Security Newsupdated Sep 30, 20:34 UTC · 8h agofirst Sep 30, 16:28 UTC · 12h agoThreat actor in the wild 9 sources

Russia's Star Blizzard Ditches ClickFix to Widen Phishing Net

Russian APT Star Blizzard replaced ClickFix with RedFlick phishing to deliver CosmicPulse against Ukraine-linked targets.

Dark Reading reports that Russian APT Star Blizzard has stopped using ClickFix and adopted a phishing tactic dubbed RedFlick. The activity targets Ukrainian-linked NGOs, think tanks, and journalists. The stated objective is deployment of the group's CosmicPulse backdoor. The available text does not include indicators, infrastructure, or a technical description of RedFlick.

Dark Readingupdated Sep 30, 20:34 UTC · 8h agofirst Sep 30, 15:02 UTC · 13h agoThreat actor in the wild 9 sources

RedFlick Uses Scheduled Tasks and Password-Protected Archives to Deploy CosmicPulse Backdoor

Star Blizzard ran 13 RedFlick phishing campaigns in 2026, deploying CosmicPulse against more than 100 organizations.

Microsoft says Star Blizzard, which CISA attributes to Russia's FSB Center 18, ran at least 13 RedFlick phishing campaigns from January to August 2026 against more than 100 organizations, mainly in the United States and United Kingdom, plus Ukrainian and Ukraine-related targets. After an attachment-free lure, the group sends a password-protected ZIP or RAR with the password in an image, then uses disguised LNK files, scheduled tasks, WebDAV, and a CPL downloader to install the CosmicPulse backdoor, also known as YESROBOT. A July variant nests a RAR inside a ZIP and hides Base64 in a PDF that PowerShell decodes to fetch another MSI. Microsoft urges hunting for the three named scheduled tasks and related Windows binary abuse.

GBHackersupdated Sep 30, 20:34 UTC · 8h agofirst Sep 30, 13:38 UTC · 15h agoThreat actor in the wild 9 sources

Russian FSB-linked hackers scale up phishing attacks against Ukraine supporters

FSB-linked Star Blizzard expanded phishing, hitting over 100 organizations with RedFlick and the CosmicPulse backdoor.

Microsoft reported that Star Blizzard, also known as Callisto and ColdRiver and linked to Russia's FSB, has run at least 13 large phishing campaigns since January 2026 against more than 100 organizations, mainly in the United States and the United Kingdom, plus Ukrainian targets and Ukraine supporters. The group now sends password-protected archives that trigger RedFlick, which uses scheduled tasks to install the CosmicPulse backdoor, replacing the multi-step ClickFix method. Earlier lures impersonated Ukrainian tax authorities via Ukr.net; later waves used fake conference invitations and accounts on compromised websites.

The Recordupdated Sep 30, 20:34 UTC · 8h agofirst Sep 30, 12:00 UTC · 17h agoThreat actor in the wild 9 sources

Russian APT Star Blizzard Uses ‘RedFlick’ Infection Chain in Recent Attacks

Microsoft says Russian APT Star Blizzard now delivers backdoors through its RedFlick phishing chain.

Microsoft says Russian state-sponsored Star Blizzard, linked to FSB Centre 18, is using a new RedFlick delivery chain in observed 2026 attacks. After a phishing reply, victims receive a password-protected archive or VHDX containing a shortcut disguised as a PDF; one click opens a decoy while a script fetches an MSI, creates scheduled tasks, and launches NoroBot or BaitSwitch to deliver the CosmicPulse Python backdoor. From January through August the group ran more than a dozen campaigns against Ukrainian targets and supporting NGOs, think tanks, governments, and financial institutions. Later activity added extra scheduled tasks and a PowerShell stage.

SecurityWeekupdated Sep 30, 20:34 UTC · 8h agofirst Sep 30, 10:59 UTC · 18h agoThreat actor in the wild 9 sources

CosmicPulse

Timeline5 articles

Appears with

Russian Hackers Target 100+ Organizations With New RedFlick Phishing Attack

Russia's Star Blizzard Ditches ClickFix to Widen Phishing Net

RedFlick Uses Scheduled Tasks and Password-Protected Archives to Deploy CosmicPulse Backdoor

Russian FSB-linked hackers scale up phishing attacks against Ukraine supporters

Russian APT Star Blizzard Uses ‘RedFlick’ Infection Chain in Recent Attacks