[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$finXYvL_y2YhTdeSqScxEVlZLgMS3qFyN2kqSLPxhWYE":3},{"article":4,"iocs":55,"watch_terms":63,"solutions":64,"lesson":154},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":32,"category":33,"article_tags":37},"eaec4a1d-7922-41d9-86bb-dccea9a4de2e","Russian state hackers use new RedFlick technique to push malware","russian-state-hackers-use-new-redflick-technique-to-push-malware-2d28f4","The Russian state actor Star Blizzard has been using a new malware installation tactic dubbed \"RedFlick\" to deploy its signature CosmicPulse backdoor. [...]","Russian state-sponsored threat actor Star Blizzard has developed a new malware installation tactic called 'RedFlick' to automate the deployment of its CosmicPulse backdoor. This technique involves a multi-stage process starting with phishing emails containing password-protected archives with VHDX virtual disks. Upon opening a malicious LNK file, a hidden command executes an MSI installer that sets up scheduled tasks to evade detection and download the final payload.","Russian state actor Star Blizzard uses new RedFlick technique to deploy CosmicPulse backdoor.","https:\u002F\u002Fwww.bleepingcomputer.com\u002Fnews\u002Fsecurity\u002Frussian-state-hackers-use-new-redflick-technique-to-push-malware\u002F","https:\u002F\u002Fwww.bleepstatic.com\u002Fcontent\u002Fhl-images\u002F2026\u002F05\u002F15\u002FRussia.jpg","2026-09-30T20:34:01+00:00","2026-09-30T22:00:32.273606+00:00",8,[17,20,23,26,28,30],{"name":18,"type":19},"Star Blizzard","threat_actor",{"name":21,"type":22},"CosmicPulse","product",{"name":24,"type":25},"VHDX","technology",{"name":27,"type":25},"LNK file",{"name":29,"type":25},"MSI installer",{"name":31,"type":22},"Python 3.8 64-bit","6cbdd207-aaa1-4176-9534-e156b125e917",{"id":32,"icon":34,"name":35,"slug":36},null,"Nation-state","nation-state",[38,43,45,50],{"category":39},{"id":40,"icon":34,"name":41,"slug":42},"26b0b636-0e31-4db1-bffb-61bdf9f20a58","Supply Chain","supply-chain",{"category":44},{"id":32,"icon":34,"name":35,"slug":36},{"category":46},{"id":47,"icon":34,"name":48,"slug":49},"89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5","Malware","malware",{"category":51},{"id":52,"icon":34,"name":53,"slug":54},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[56,58,61],{"type":49,"value":21,"context":57},"Backdoor deployed by Star Blizzard",{"type":49,"value":59,"context":60},"NOROBOT","Downloader used in RedFlick attacks",{"type":49,"value":62,"context":60},"BAITSWITCH",[21,31],{"controls":65,"vendors":150},[66,95,121],{"slug":67,"name":68,"problem":69,"products":70},"phishing-resistant-mfa","Phishing-resistant MFA","A stolen password, or a user who taps Approve on a push prompt, is no longer enough to log in.",[71,79,87],{"vendor_slug":72,"vendor_name":73,"vendor_logo":74,"product_slug":75,"product_name":76,"url":77,"description":78},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","entra-id","Microsoft Entra ID","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fidentity-access\u002Fmicrosoft-entra-id","Cloud identity and access management with single sign-on, conditional access, passkeys and identity governance.",{"vendor_slug":80,"vendor_name":81,"vendor_logo":82,"product_slug":83,"product_name":84,"url":85,"description":86},"okta","Okta","\u002Fvendor-logos\u002Fokta.png","workforce-identity","Okta Workforce Identity","https:\u002F\u002Fwww.okta.com\u002Fproducts\u002Fworkforce-identity\u002F","Single sign-on, adaptive MFA including phishing-resistant methods, and lifecycle management for employees.",{"vendor_slug":88,"vendor_name":89,"vendor_logo":90,"product_slug":91,"product_name":92,"url":93,"description":94},"yubico","Yubico","\u002Fvendor-logos\u002Fyubico.png","yubikey","YubiKey","https:\u002F\u002Fwww.yubico.com\u002Fproducts\u002F","Hardware security keys for FIDO2, passkeys and smart card login, in USB and NFC versions.",{"slug":96,"name":97,"problem":98,"products":99},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[100,105,113],{"vendor_slug":72,"vendor_name":73,"vendor_logo":74,"product_slug":101,"product_name":102,"url":103,"description":104},"defender-for-endpoint","Microsoft Defender for Endpoint","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fendpoint-security\u002Fmicrosoft-defender-endpoint","Endpoint detection and response for Windows, macOS, Linux and mobile devices.",{"vendor_slug":106,"vendor_name":107,"vendor_logo":108,"product_slug":109,"product_name":110,"url":111,"description":112},"elastic","Elastic","\u002Fvendor-logos\u002Felastic.png","elastic-security","Elastic Security","https:\u002F\u002Fwww.elastic.co\u002Fsecurity","SIEM and endpoint security built on Elasticsearch, with open detection rules.",{"vendor_slug":114,"vendor_name":115,"vendor_logo":116,"product_slug":117,"product_name":118,"url":119,"description":120},"bitdefender","Bitdefender","\u002Fvendor-logos\u002Fbitdefender.png","gravityzone","GravityZone","https:\u002F\u002Fwww.bitdefender.com\u002Fen-us\u002Fbusiness\u002Fgravityzone-platform\u002F","Endpoint protection, detection and response platform.",{"slug":122,"name":123,"problem":124,"products":125},"email-security","Email security","Phishing, malware and invoice fraud are filtered out before they reach inboxes.",[126,134,142],{"vendor_slug":127,"vendor_name":128,"vendor_logo":129,"product_slug":130,"product_name":131,"url":132,"description":133},"cloudflare","Cloudflare","\u002Fvendor-logos\u002Fcloudflare.png","cloudflare-email-security","Cloudflare Email Security","https:\u002F\u002Fwww.cloudflare.com\u002Fsase\u002Fproducts\u002Femail-security\u002F","Email filtering for phishing and business email compromise.",{"vendor_slug":135,"vendor_name":136,"vendor_logo":137,"product_slug":138,"product_name":139,"url":140,"description":141},"darktrace","Darktrace","\u002Fvendor-logos\u002Fdarktrace.png","darktrace-email","Darktrace \u002F EMAIL","https:\u002F\u002Fwww.darktrace.com\u002Fproducts\u002Femail","Email security that flags messages deviating from normal communication patterns.",{"vendor_slug":143,"vendor_name":144,"vendor_logo":145,"product_slug":146,"product_name":147,"url":148,"description":149},"proofpoint","Proofpoint","\u002Fvendor-logos\u002Fproofpoint.png","core-email-protection","Proofpoint Core Email Protection","https:\u002F\u002Fwww.proofpoint.com\u002Fus\u002Fproducts\u002Femail-protection","Email filtering for phishing, malware and business email compromise.",[151],{"slug":72,"name":73,"logo_path":74,"roles":152},[153],"reported_by",{"slug":155,"title":156,"body":157,"framework_refs":158,"framework_notes":171},"star-blizzards-redflick-technique-abuses-virtual-disks-and-lnk-files-to-deploy-backdoor","Star Blizzard's RedFlick Technique Abuses Virtual Disks and LNK Files to Deploy Backdoor","Russian state-sponsored group Star Blizzard has weaponized a sophisticated multi-stage attack chain — dubbed RedFlick — that begins with a phishing email and leverages password-protected archives, VHDX virtual disk files, malicious LNK shortcuts, and MSI installers to silently deploy the CosmicPulse backdoor. The use of password-protected archives is specifically designed to bypass email gateway scanning, while VHDX files bypass Mark-of-the-Web (MotW) protections that would normally warn users about untrusted content. Scheduled tasks are then used to establish persistence and evade endpoint detection tools. This attack highlights how social engineering, combined with abuse of legitimate Windows features, can circumvent multiple layers of traditional defenses. Organizations that lack user training, endpoint telemetry, and restrictive execution policies remain highly exposed to this class of threat.",[159,160,161,162,163,164,165,166,167,168,169,170],"CIS Control 9 – Email and Web Browser Protections","CIS Control 10 – Malware Defenses","CIS Control 14 – Security Awareness and Skills Training","CIS Control 17 – Incident Response Management","NIST SP 800-53 SI-3 – Malicious Code Protection","NIST SP 800-53 AC-6 – Least Privilege","NIST SP 800-53 AU-12 – Audit Record Generation","NIST SP 800-53 SC-18 – Mobile Code","MITRE ATT&CK T1566.001 – Phishing: Spearphishing Attachment","MITRE ATT&CK T1553.005 – Subvert Trust Controls: Mark-of-the-Web Bypass","MITRE ATT&CK T1053.005 – Scheduled Task\u002FJob: Scheduled Task","MITRE ATT&CK T1218.007 – System Binary Proxy Execution: Msiexec",{}]