Russian state hackers use new RedFlick technique to push malware

Russian state-sponsored group Star Blizzard has weaponized a sophisticated multi-stage attack chain — dubbed RedFlick — that begins with a phishing email and leverages password-protected archives, VHDX virtual disk files, malicious LNK shortcuts, and MSI installers to silently deploy the CosmicPulse backdoor. The use of password-protected archives is specifically designed to bypass email gateway scanning, while VHDX files bypass Mark-of-the-Web (MotW) protections that would normally warn users about untrusted content. Scheduled tasks are then used to establish persistence and evade endpoint detection tools. This attack highlights how social engineering, combined with abuse of legitimate Windows features, can circumvent multiple layers of traditional defenses. Organizations that lack user training, endpoint telemetry, and restrictive execution policies remain highly exposed to this class of threat.