RedFlick (Malware): news timeline & CVEs

Russian Hackers Target 100+ Organizations With New RedFlick Phishing Attack

Star Blizzard used RedFlick phishing against 100-plus organizations and later deployed the CosmicPulse backdoor.

Field Effect says Star Blizzard, also known as ColdRiver and Callisto, ran at least 13 phishing campaigns from January through August 2026 against more than 100 organizations, chiefly in the United States and United Kingdom. Targets included government, diplomacy, research, policy, journalism, and finance groups involved in Ukraine-related work. Initial emails have no attachments; replies are followed by password-protected RAR or ZIP archives that may contain a VHDX disk or an LNK file disguised as a PDF. From April, RedFlick installers created scheduled tasks, enabled WebDAV, and deployed the CosmicPulse backdoor, a sequence Microsoft observed in at least one incident.

Cyber Security Newsupdated Sep 30, 20:34 UTC · 8h agofirst Sep 30, 16:28 UTC · 12h agoThreat actor in the wild 9 sources

Russian FSB-linked hackers scale up phishing attacks against Ukraine supporters

FSB-linked Star Blizzard expanded phishing, hitting over 100 organizations with RedFlick and the CosmicPulse backdoor.

Microsoft reported that Star Blizzard, also known as Callisto and ColdRiver and linked to Russia's FSB, has run at least 13 large phishing campaigns since January 2026 against more than 100 organizations, mainly in the United States and the United Kingdom, plus Ukrainian targets and Ukraine supporters. The group now sends password-protected archives that trigger RedFlick, which uses scheduled tasks to install the CosmicPulse backdoor, replacing the multi-step ClickFix method. Earlier lures impersonated Ukrainian tax authorities via Ukr.net; later waves used fake conference invitations and accounts on compromised websites.

The Recordupdated Sep 30, 20:34 UTC · 8h agofirst Sep 30, 12:00 UTC · 17h agoThreat actor in the wild 9 sources

Russian APT Star Blizzard Uses ‘RedFlick’ Infection Chain in Recent Attacks

Microsoft says Russian APT Star Blizzard now delivers backdoors through its RedFlick phishing chain.

Microsoft says Russian state-sponsored Star Blizzard, linked to FSB Centre 18, is using a new RedFlick delivery chain in observed 2026 attacks. After a phishing reply, victims receive a password-protected archive or VHDX containing a shortcut disguised as a PDF; one click opens a decoy while a script fetches an MSI, creates scheduled tasks, and launches NoroBot or BaitSwitch to deliver the CosmicPulse Python backdoor. From January through August the group ran more than a dozen campaigns against Ukrainian targets and supporting NGOs, think tanks, governments, and financial institutions. Later activity added extra scheduled tasks and a PowerShell stage.

SecurityWeekupdated Sep 30, 20:34 UTC · 8h agofirst Sep 30, 10:59 UTC · 18h agoThreat actor in the wild 9 sources

RedFlick

Timeline3 articles

Appears with

Russian Hackers Target 100+ Organizations With New RedFlick Phishing Attack

Russian FSB-linked hackers scale up phishing attacks against Ukraine supporters

Russian APT Star Blizzard Uses ‘RedFlick’ Infection Chain in Recent Attacks