Star Blizzard's RedFlick Technique Abuses Virtual Disks and LNK Files to Deploy Backdoor
Written by AI from the linked story. Not reviewed by an editor. How this works
Russian state-sponsored group Star Blizzard has weaponized a sophisticated multi-stage attack chain — dubbed RedFlick — that begins with a phishing email and leverages password-protected archives, VHDX virtual disk files, malicious LNK shortcuts, and MSI installers to silently deploy the CosmicPulse backdoor. The use of password-protected archives is specifically designed to bypass email gateway scanning, while VHDX files bypass Mark-of-the-Web (MotW) protections that would normally warn users about untrusted content. Scheduled tasks are then used to establish persistence and evade endpoint detection tools. This attack highlights how social engineering, combined with abuse of legitimate Windows features, can circumvent multiple layers of traditional defenses. Organizations that lack user training, endpoint telemetry, and restrictive execution policies remain highly exposed to this class of threat.
Tactical Insight
Immediate actions
- Block or quarantine inbound password-protected archive files (ZIP, RAR, 7z) at the email gateway and require manual review before delivery.
- Disable or restrict VHDX/VHD auto-mounting via Group Policy to prevent virtual disk-based MotW bypass attacks.
- Enable and enforce Windows Defender Attack Surface Reduction (ASR) rules to block LNK-based execution of malicious scripts and MSI installers.
Long-term improvements
- Conduct regular phishing simulation exercises focused on spear-phishing scenarios involving file attachments to build user recognition of this attack vector.
- Implement application whitelisting (e.g., AppLocker or WDAC) to prevent unauthorized MSI installers and scheduled task creation by non-administrative processes.
- Enforce the principle of least privilege so that standard users cannot mount virtual disks or register scheduled tasks without elevated approval.
Detection measures
- Monitor and alert on unusual scheduled task creation events (Windows Event IDs 4698, 4702) from non-standard parent processes.
- Deploy EDR/XDR tooling with behavioral detection rules targeting LNK-to-MSI-to-scheduled-task execution chains.
- Centralize and correlate endpoint logs in a SIEM with threat intelligence feeds referencing Star Blizzard/SEABORGIUM indicators of compromise.