Russian state threat actor Star Blizzard is using email conversations to deliver malware after victims respond to seemingly harmless messages.
Microsoft Threat Intelligence detailed the activity in a September 29, 2026, report, describing a delivery technique called RedFlick that supports installation of the CosmicPulse backdoor.
Microsoft observed at least 13 large phishing campaigns between January and August 2026. The activity affected more than 100 organizations, primarily in the United States and United Kingdom.
Targets included government agencies, think tanks, financial institutions, and organizations supporting Ukraine.
The campaigns mark a shift from carefully selected spear-phishing targets toward broader outreach. Attackers send invitations to policy discussions, conferences, and private meetings, using familiar names and organizations to encourage recipients to reply.
Russian Hackers Await Replies
Once a recipient responds, the attackers typically send a password-protected RAR or ZIP archive. They provide the password as an image inside the email. The attachment contains files that begin the RedFlick infection process.
This approach separates the initial contact from malware delivery. The opening message usually contains no attachment, while the later archive arrives within an established conversation.
Encryption can prevent tools without decryption capabilities from inspecting its contents. Early campaigns used password-protected ZIP files containing virtual hard disk files with the VHDX extension.
Inside these disks, Windows shortcut files appeared to be PDF documents but launched malicious commands when opened. The shortcut started Windows utilities and a batch script.
That script displayed a legitimate decoy PDF while using SSH to download and execute an MSI installer. A scheduled task then launched a CosmicPulse downloader disguised as a Control Panel applet.
Starting in April, the installers created three scheduled tasks disguised as network maintenance components.
These tasks collected the computer name and username, supported WebDAV access, and retrieved additional malware from attacker-controlled infrastructure.
The task names included “Internet Quality Test Connection,” “Network Configuration Manager,” and “System Health Monitor.” Microsoft observed CosmicPulse deployment through these tasks in at least one incident.
In July, attackers added another layer by placing a password-protected RAR archive inside a ZIP file.
Its shortcut downloaded a PDF containing hidden, encoded instructions. PowerShell extracted and executed those instructions to retrieve another MSI installer.
CosmicPulse is a Python backdoor that gives attackers persistent access. Its downloader retrieves supporting files, stores an encrypted key in the Windows registry, and launches the decoded payload.
Organizations should investigate unexpected encrypted attachments, especially those received after an invitation or conversation.
Users should verify senders through a trusted contact method rather than relying on recognizable names in email addresses, fieldeffect said.
Security teams can monitor suspicious shortcut execution, PowerShell commands, MSI installation, outbound SSH traffic, and newly created scheduled tasks. These behaviors offer detection opportunities after an archive reaches an endpoint.
Join 16,000+ SOC teams using ANY.RUN to streamline threat investigations and reduce manual effort. Explore for your team
