Star Blizzard Sends RedFlick Archives to Plant Windows Tasks

A reply to a conference invitation can now be the point where Star Blizzard’s phishing becomes a Windows foothold. In Microsoft Threat Intelligence’s September 29 account, the Russian state actor sends an initial message, waits for engagement, then delivers a password-protected archive. Opening its disguised shortcut starts the RedFlick delivery chain; the actor’s installer can create scheduled tasks that retrieve its CosmicPulse backdoor. Microsoft observed at least 13 distinct large-scale campaigns since January 2026 and says the activity affected more than 100 organizations, primarily in the United States and United Kingdom. For incident scoping, use that figure as a measure of campaign reach and confirm compromise from endpoint evidence.

Government offices, Ukraine-linked NGOs, think tanks, financial organizations and individuals involved in policy are among the targets. The lure might promise a closed-door discussion or a payment notice. The follow-up archive is the hinge: the first email can look like ordinary correspondence, while the later attachment asks a person who has already replied to open a locked file. Microsoft says the RedFlick infection flow “only requires a single user interaction,” compared with earlier ClickFix lures that required several.

The reply delivers the loader

Microsoft describes January lures that put a .lnk shortcut dressed as a PDF inside a .vhdx disk image, itself inside a protected .zip. The shortcut launches a decoy PDF and a script; a downloaded MSI then installs a scheduled task. By April, the MSI had expanded to three tasks. In July, another archive exposed a shortcut that downloaded a PDF carrying encoded follow-on data; the extracted stage tried to install an MSI. The chain varied between campaigns.

Digital Security Lab Ukraine traced a June invitation impersonating a real Ukraine Recovery Conference contact: the first message said a form was attached when none was there; after a recipient asked, the reply delivered URC_2026_Official_Invitation.zip and an image containing its password. The archive arrived after engagement. It carried Files.vhdx and a document-looking shortcut. The lab found four recurring tasks in that case, including SecureDNSObserver; its final WebDAV payload remains unidentified.

Google Threat Intelligence Group’s October 2025 research described an earlier COLDRIVER/Star Blizzard ClickFix page that induced a user to run a malicious DLL. Google observed only two YESROBOT Python-backdoor deployments in late May 2025 before a shift to MAYBEROBOT in the period it studied. Microsoft calls its 2026 Python backdoor CosmicPulse, also known as YESROBOT; the new defender lead is the reply-stage attachment and Windows-task delivery path.

Three tasks hide in Windows

Microsoft names April’s tasks Internet Quality Test Connection, Network Configuration Manager and System Health Monitor. The first sends host and user information to attacker infrastructure and can invoke a remote DLL through Shell32.dll and WebDAV; the second prepares Windows’ WebDAV redirector through the WebClient service; the third uses control.exe to reach a remote applet. Microsoft observed the first or third task deploy CosmicPulse in at least one incident. Its downloader writes an encrypted key under HKEY_CURRENT_USER\Software\Classes\.mollis and unpacks a Python stage.

A task that runs control.exe can load a remote applet through a WebDAV UNC path: Windows shows a file-share path while fetching the content over HTTP. Read the action, trigger and remote path. The spawning process tells you what the task actually did. Microsoft says it could not obtain one first-task DLL variant. Keep a host with the task or its command line in the investigation even if that particular next-stage sample is unavailable.

For recognition, search your endpoint process, task and registry telemetry for those three task names. In Defender XDR, Microsoft’s hunting examples use DeviceProcessEvents, DeviceEvents and DeviceRegistryEvents; its July query pairs conhost.exe with curl, and its January query looks for ssh.exe with PermitLocalCommand=yes and LocalCommand=cmd.exe. Microsoft’s seven-day example window is a starting point: widen it to cover the mail thread and the host’s retention. The vendor cautions that the process patterns can have unrelated matches. Correlate each hit with the reply, archive, installer and task action before assigning it to Star Blizzard.

The June lab case adds SecureDNSObserver, user agents WindowsUpdatesMonitor and DNSObserver, and a DOMAIN\HOST\USER fingerprint encoded in outbound requests. Look for those values on hosts associated with the reported lure, alongside URC_2026_Official_Invitation.zip, Files.vhdx and URC_2026_Official_Invitation.lnk. The lab’s four-task finding belongs to its own case; Microsoft describes a three-task April variant.

Match infrastructure with host evidence

Microsoft’s published infrastructure indicators, kept defanged here, are installer or downloader hosts: etia[.]ca, groy[.]cc, muvb[.]net, matjk[.]click, bpdaersa[.]click, Itechx[.]tel, guach[.]net, byveo[.]org, cyrna[.]top, 103.245.231[.]248, 2.57.241[.]246, 89.125.209[.]168, 103.245.231[.]79, 45.84.59[.]66 and 103.160.59[.]97. Its backdoor or downloader hosts include gliderrompercycl[.]com, divekickspolic[.]org, stuseamandesilt[.]org, ruten[.]observer, secure-dns-hub[.]com, qumel[.]link and drasw[.]club. The lab additionally lists 89.125.66[.]183 for its June WebDAV case.

For attachment matching, Microsoft’s SHA-256 values include January Documents.zip 9707a8694e954e9ee13e839d6e5905ce626c0837c7c90da6d1025bfbe152866b and Documents.vhdx 1f2096ff906915fbf80778f0636446206197351f7e271af97936eeb6f32c179d; June Chatham_London_Conference_2026_Invitation.rar 699e92a9e0edf7835879d5697bc67138c0b137117f459caf1a44df357407cad9; July USUBC_Private_Executive_Roundtable_Webex.rar 24b6e36a09eb2acfc2a95478ca685acb7593b1689be6a4a639fe0d222393cfa7; and August Payment Advice Note.zip dd98dbc1a55afe6fd0ed2ed53a79c76f6bde15081a0060422185b74eb1799ee4. In August, Microsoft says the actor sent unique ZIP files to individual targets; investigate a suspicious reply through its sender thread and host activity even when its hash is new.

The lab’s June attachment hashes provide a separate pivot: URC_2026_Official_Invitation.zip 99f971a9256dff777dce7c4165b794f9cedbc0e62426351ad31ff6dcb09cf7cd, Files.vhdx 831ef80ba20a69ec20009a33bf39b266932d5d0f85bd761d9fdb1c071cb0e7ee and URC_2026_Official_Invitation.lnk c0004f96f305ae93dd4067c6637c8f4edafb122d4bf4cad7b7e42084a3aa1408. Match hashes against attachment captures. Then pivot to the receiving device’s task and process events. Microsoft’s Sentinel guidance uses _Im_NetworkSession and _Im_WebSession to match destination indicators; correlate a network hit with host task and process activity before classifying it as a deployed backdoor.

Investigate the reply and task

For a targeted mailbox, preserve both messages and identify where the attachment was opened. Quarantine matching follow-up archives, investigate hosts with the three Microsoft task names or the lab’s SecureDNSObserver, and inspect the task actions and outbound WebDAV destinations. Where you find an installed malicious task or backdoor, contain the endpoint and follow incident response for account and host recovery. A mail rule that inspects only the first message misses the archive delivered after a reply.

Change the path for the next lure: have staff confirm invitations and payment notices through an already trusted contact channel before opening protected archives; enforce phishing-resistant authentication and conditional access for exposed identities. Microsoft also recommends Safe Attachments, Safe Links, endpoint detection and response in block mode, and network protection. Microsoft evaluates its own Defender products in the report, so use its named detections as leads and validate their coverage in your deployment.

A useful verification test is to search task registration and process telemetry for the four named tasks over the email thread’s time span, then open each match’s recorded action and sender thread. A clean review finds no unexplained remote control.exe or WebDAV action on recipients’ devices; any match gets host-level triage, including cases where the next-stage payload was never recovered.