Loading malware…
RedFlick is a Windows malware delivery and execution chain used by Star Blizzard, a Russian state-linked threat actor also known as ColdRiver and Callisto and associated with Russia’s Federal Security Service. It deploys the actor’s CosmicPulse backdoor through scripts, legitimate Windows utilities, installers, and scheduled tasks. RedFlick reduces the user interaction required compared with the actor’s earlier ClickFix-based infection chains.
Delivery typically begins with attachment-free phishing correspondence intended to establish a conversation. After a recipient responds, the attacker sends a password-protected archive, often using conference invitations, research collaboration, policy discussions, or financial correspondence as lures. Archive passwords may be embedded as images in email messages, while encryption limits inspection by security controls unable to decrypt attachments. Archives contain virtual disk images or Windows shortcuts disguised as PDF documents. Opening a malicious file initiates retrieval and execution of additional components.
RedFlick installers create scheduled tasks that collect and transmit basic host information, enable WebDAV functionality, and retrieve and execute subsequent payloads. Scheduled tasks support persistence, while task names resembling legitimate network or system maintenance functions and the use of trusted utilities help conceal malicious activity. A July 2026 variant used nested archives and PowerShell commands encoded within a downloaded PDF to retrieve an installer. The chain ultimately installs CosmicPulse, providing persistent backdoor access to Windows endpoints.
RedFlick has been used in Star Blizzard phishing operations affecting more than 100 organizations, primarily in the United States and United Kingdom. Targets include government, diplomatic, research, public-policy, journalism, nongovernmental, and financial organizations connected to Ukraine-related activities.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
Beginning in April 2026, RedFlick installers created scheduled tasks that collected basic host information, enabled Web Distributed Authoring and Versioning (WebDAV) access, and retrieved components used to install the CosmicPulse backdoor.
15 distinct techniques documented for this family, organized by ATT&CK tactic.
Upon opening a file within the archive, RedFlick uses scheduled tasks to install the CosmicPulse backdoor.
L’installeur MSI crée trois tâches planifiées masquées en composants réseau légitimes.
Archive RAR dans ZIP → LNK → curl télécharge un PDF contenant une charge utile Base64 encodée ... → PowerShell → MSI → tâches planifiées.
Le BAT invoque SSH.exe avec PermitLocalCommand pour télécharger un installeur MSI distant.
Une archive RAR ou ZIP protégée par mot de passe... un PDF contenant une charge utile Base64 encodée.
“After downloading the PDF, the command runs a second PowerShell payload. This payload searches the PDF for the magic header cAB [and] extracts ... Base64-encoded data.”
The follow-up message carries a password-protected RAR or ZIP archive, while its password appears as an image in the email... In July, the operators added another layer by placing a password-protected RAR archive inside a ZIP file.
6 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A malware delivery mechanism used by Star Blizzard that is delivered in a password-protected archive and, after the victim opens an included file, uses scheduled tasks to install the CosmicPulse backdoor with a single user action.
A Star Blizzard phishing-delivery chain that uses attachment-free initial contact followed by encrypted archives containing VHDX or LNK files. The files invoke scripts and legitimate Windows utilities to retrieve further payloads, establish scheduled-task persistence, enable WebDAV access, and install CosmicPulse.
A malware-delivery mechanism used by Star Blizzard that is triggered from a file in a password-protected archive and uses scheduled tasks to install the CosmicPulse backdoor with reduced detection.
Multi-stage malware delivery chain used by Star Blizzard to deploy CosmicPulse on Windows endpoints. Following an initial email conversation, victims receive password-protected archives containing VHDX files or LNK shortcuts disguised as PDFs. Execution launches scripts and legitimate Windows utilities to retrieve additional components. RedFlick installers create scheduled tasks, collect host information, and enable WebDAV access. A July variant nested a protected RAR archive inside a ZIP file and used a shortcut to download a PDF containing encoded data that PowerShell extracted and executed to retrieve an MSI installer.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.